The problem here is that nothing in that build is pinned. It builds with nightly, but doesn't define which version / date. We also don't know how it's build. I

The problem here is that nothing in that build is pinned. It builds with nightly, but doesn't define which version / date. We also don't know how it's build. Ideally there is a Docker container out there that does just an import of source code and then builds. No apk install or apt install (you'd do that in a base published layer). Referenced with an SHA256. We then use this Docker container to pull in the source code AND its dependencies based on a Cargo.lock. Which... isn't there. So we don't know the exact dependencies that went in. (Even if there were a Cargo.lock, we need to make sure we actually respect it. I believe cargo install by default ignores the lock file and tries to get the latest version that matches).