We build on official releases and add our own artefacts. So we might pin to a microsoft dotnet hash, a JVM hash, a nodejs hash, and in our pipeline add a releas

We build on official releases and add our own artefacts. So we might pin to a microsoft dotnet hash, a JVM hash, a nodejs hash, and in our pipeline add a released application to that container. There are no packages installed, only files added, including an entry point. This is then signed and stored, along with the source commit and source image. This way we can reproduce at will, but also make use of the very large ecosystem of suppliers, consultants and communities that already exist. Edit: the other resources (source, source image) are also packaged as OCI images and signed and stored so you have everything available in the registry, even if the source repositories were to cease to exist. Because everything else we run interfaces with OCI registries by default we don't have to re-invent that wheel.