Merkle trees and build systems

Mostly because they _pretend_ to be declarative descriptions of the resulting image, while introducing subtle non-reproducible bugs.

Just take a typical Dockerfile from Github: https://github.com/wurstmeister/kafka-docker/blob/master/... - this is random example from using their code search function.

You can see that it does: "apk add --no-cache bash curl jq docker" - basically installs the most recent available version of packages, without any notion of "lockfiles".