> It should be safe to assume that Dockerfile create the same (or really similar) image everytime Nope. Most of the Dockerfiles I've seen will do wildly-unrepr

> It should be safe to assume that Dockerfile create the same (or really similar) image everytime Nope. Most of the Dockerfiles I've seen will do wildly-unreproducible things, like running apt/pip/yum/npm/mvn/sbt/etc. without even giving any version numbers (let alone expected hashes) This seems to be pretty rampant; for example, here's some AWS documentation which encourages such reckless behaviour (even giving the '-y' option to apt-get!): https://docs.aws.amazon.com/AmazonECS/latest/developerguide/create-container-image.html#create-container-image-create-image https://docs.aws.amazon.com/AmazonECS/latest/developerguide/...