Image Build Model

Everything under the directory the build was pointed at, recursively, minus whatever the ignore rules exclude. That packaged set is the build context, and it is transferred before step one. An instruction can only read files that are inside it.

Everyone who can pull the image, and everyone already holding a copy of it. The value sits in a read-only layer and in the build record that travels with it, so pull access is credential access.

Each build step's reuse depends on the layer it starts from. The edit changed the inputs of the step that copies that file, so the step ran again and wrote a new layer - and every later step then started somewhere new and missed.

A single-stage build ships everything the build needed, not only what the run needs: the compiler toolchain, development headers, the whole source tree, intermediate output and package-manager caches all stay in the image's layers beside the 40 MB artifact.

The image carries no trusted-certificate store. A full distribution base ships a maintained set of root certificates; a stripped base does not, so the client has nothing to check the presented chain against and rejects every server it meets.

Keep the file out of the set that is sent. A copy instruction can only take files that were packaged, so ignore rules at the context root close the hole for every instruction and every future one; narrowing that single copy only closes it once.

A step-scoped mount exposes the value only while one step runs and leaves it out of both that step's layer and the recorded build inputs. A build argument or environment value is part of the build and ships inside the image.

Almost always the build copies the whole project into the image before it installs dependencies. That makes every source file an input of the copy step, so each commit invalidates it and forces a full dependency fetch on every single build.

The artifact is linked dynamically against system libraries the build host supplied and the empty base does not. Nothing resolves its dependencies at start-up, so it dies before the first line of its own code runs.

Because the build was pointed at a working tree full of things no instruction needs — installed dependencies, earlier build output, test fixtures, version-control metadata — and the packaging step takes all of it. The lever is the set that is sent, not the machine.

Because layers stack rather than overwrite. The later step records that the path is hidden; the earlier layer that wrote the credential is unchanged, still transferred on every pull, and still readable by unpacking the layers.

Three: the identity of the layer the step starts from, the step's own definition including any argument values in it, and, for a step that copies files in, the content of those files. What the step produced is not an input.

Non-deterministic inputs the build recorded: embedded build timestamps, file modification times and archive entry ordering, absolute build paths and host names, and a base image whose reference resolved to different bytes. Each changes layer bytes, so the digest changes.

Only the files you explicitly copy, at the paths you name. The final stage begins from its own base with an independent filesystem, so installed packages, environment values, created users, the working directory and the entry command do not carry over.

The image's owner does. A full distribution base carries a maintained package set that a rebase refreshes; anything hand-copied onto a minimal or empty base has no upstream feed behind it, so nothing triggers a rebuild when it changes.

Because a rule that is written is not a rule that matched. It can be anchored differently than assumed, be a pattern that matches nothing at all, be undone by a later re-including rule, or belong to a context root that this particular invocation did not use.

Make the token stop being accepted at whatever issued it. Publication is one-way: every copy of that image stays pullable and readable, so no registry cleanup and no rebuild can take the value back.

Because nothing the builder compares had changed: the step's definition was fixed, the layer beneath it was the same, and it copied no files. Reuse is a promise about a step's inputs, never about the freshness of what it fetched.

Because the builder is the only place the inputs are visible. Finished bytes show what ended up in the image, not which source revision, base bytes, steps and parameters produced it, or what was used during the build and discarded.

By itself, almost nothing. Unless that build was already known to produce the same bytes twice, a mismatch cannot separate tampering or an undeclared input from ordinary build non-determinism, so it only becomes evidence once reproducibility has been established first.

The artifact needed something the final base does not ship — a system library, a certificate store, locale or timezone data, or an interpreter it was never linked statically against. Installing a toolchain to supply it restores the size, the package manager and the attack surface the staged build removed.

Weigh what the mandate buys — one patch stream, one review, one answer to "is everything rebuilt?" — against what it costs teams whose workloads need a shipped runtime, whose diagnosis assumes a shell, and who must fund migrating hundreds of existing images.

Give the tests their own stage built on the toolchain stage. The final stage copies nothing from it, so no test runner, fixture or report reaches the shipped layers, and the build can be asked to stop at that stage when you want the tests or their output.

The set stops being a walk of your disk. Whoever produces the stream or whatever the builder fetches decides the contents, so local uncommitted files never participate and the ignore-rules file becomes just another file that may or may not be applied.

When the merged work always changes together anyway, or when its intermediate output must not survive as a layer of its own. Splitting pays only where one part's inputs change far less often than the other's.

Emitted records first, for most estates: they can be adopted one build at a time, help immediately, and answer the questions people actually ask. Byte-identical reproducibility costs far more and is worth buying for the few releases that must be independently re-derivable.