You can avoid that unpredictability if you don't use the latest tag, or, better, create images or start containers from SHA256 digests. Those are guaranteed to be immutable.
I.e instead of:
Docker run --rm debian:trixie
You'd do
Docker run --rm debian:trixie@sha256:0ee9224bb31d3622e84d15260cf759bf37f08d652cc0411ca7b1f785f87ac19c
The only disadvantage of the digest approach is that you would need to manually resolve the digest that's correct for your processor arch. Using bare tags like "debian:trixie" can resolve to manifest lists (if so configured) that has Docker automatically find the right digest for your arch.
Also, at least for Debian there are official images available that use snapshot.debian.org as package repository from the get-go – unfortunately those images are not published on a daily basis yet.
> But if you read those links, you'll see that it's not quite there yet.
Anything you're referring to specifically? I think I made it pretty clear that Docker images based on package repo snapshots are not fully "there" yet.
> Docker in general can't solve reproducibility - it's the package manager within any container that does that.
No doubt, but right now the issue is that the package managers have done their part and the Docker images need to catch up.
Then you would create a Dockerfile that uses the digest SHA you want as a parent image, add your packages, build a new image from that Dockerfile with an updated tag, and push the image into the registry. a digest will be created for it once uploaded into its registry.
If you are not uploading images into registries (why?), you can use "docker save" to turn that image into a tarball and then checksum the tarball.
I.e instead of:
Docker run --rm debian:trixie
You'd do
Docker run --rm debian:trixie@sha256:0ee9224bb31d3622e84d15260cf759bf37f08d652cc0411ca7b1f785f87ac19c
The only disadvantage of the digest approach is that you would need to manually resolve the digest that's correct for your processor arch. Using bare tags like "debian:trixie" can resolve to manifest lists (if so configured) that has Docker automatically find the right digest for your arch.