Reproducible Images

[osteffenrh]

Follow-up from discussion on #88

Question is: Do we need reproducible builds for our container images?

Currently the image builds from our Dockerfiles are not reproducible. Not all dependencies are specified with exact version tags. Also it is not guaranteed that all dependencies will continue being available in the requested versions from the third-party locations.

Reproducible images would require some effort to put together and also require more work to maintain and upgrade.

[cfernald]

Unless we start having issues with older builds being dropped from the container registry, I'm not sure if we need reproducible builds as the old images should always be available. For me having static tool versions is more about preventing unpredictable changes in critical tools from container version to container version then it is about reproducibility, though this likely won't be a large issue for a given OS version, so perhaps its best to keep everything up to date and worry about it if/when it becomes a problem.