Keeping Docker images reproducible

A Dockerfile is not automatically a reproducible build. Mutable base tags, unpinned packages and configuration fetched during startup can produce different systems from the same source revision.

Constrain build inputs

Choose an explicit base version, keep package installation in a deliberate layer and record the repository state used by the build. Avoid latest tags for release artefacts and retain the resulting image identifier.

Separate image and environment

Build application code and runtime dependencies into the image, then inject environment-specific secrets and addresses at deployment. Do not rebuild the same source separately for test and production.

Test the final image

Run security, smoke and migration tests against the immutable candidate that will be deployed. Confirm signal handling, log output, writable paths and behaviour when dependent services are unavailable.