A Git commit fixes your source history, but it does not fix every input a container build consumes. Base-image tags, package repositories, build arguments, target platform, builder settings, cache behavior and timestamps can all affect the result. To find the cause, compare the two image digests and build metadata, then check which resolved input or output detail differs.
What a commit does—and does not—make reproducible
A commit identifies a particular version of the files tracked in your repository. A Docker build can also retrieve or resolve content outside that snapshot. A mutable base-image tag may point to a new image later; a package manager may see newer packages; and build-time arguments or external downloads may supply different values. A study of Docker build reproducibility identified floating versions among causes of different outputs (study).
As an Amazon Associate I earn from qualifying purchases.
So “same commit” is not the same as “same complete build inputs.” Even when the filesystem contents appear equivalent, metadata or timestamps can make the final image digest differ.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Compare the two builds in a useful order
-
Establish what digest and platform you are comparing
Record the exact output digest from each build and confirm whether it identifies a multi-platform manifest list/index or a platform-specific image. Check that both builds requested the same target platform: Docker exposes platform selection, and a multi-platform image can contain different variants for different hardware (Docker: Multi-platform builds; Docker: Build variables).
#1 Best Overall
-
Compare build configuration and source inputs
Check the Dockerfile, Dockerfile frontend, BuildKit and Buildx versions, build arguments, build context, and source references. A changed file in the context or a different argument can affect output even if the Git commit is identical. BuildKit build information can record frontend attributes, references and pins, along with the output digest (Docker: Build attestations).
-
Check what the base-image references resolved to
Compare the resolved digest, not just the tag written in
FROM. A tag is a name that can move; pinning the base image by digest makes the selected content explicit. Build information can help show image references and immutable pins (Docker: Build attestations). -
Inspect package installs and external downloads
Look for commands that query current package repositories or download unpinned artifacts. Lockfiles, explicit versions and repository snapshots can make dependency resolution more stable; verify fetched artifacts when appropriate. Compare whether each build actually executed an install command or reused a cached layer. Docker notes that a
RUNinstruction’s cache is not automatically invalidated between builds (Docker: Cache invalidation).Free tools Windows power users keep installed
One-click scans. No signup required.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Compare timestamps and image metadata
Inspect layer and image-configuration timestamps. Docker supports
SOURCE_DATE_EPOCHto set timestamps and recommends using a fixed value when repeatability is more important than varying timestamps. Docker specifically warns: “ChangingSOURCE_DATE_EPOCHbetween builds invalidates the cache forWORKDIRand all subsequent instructions.” (Docker: Cache invalidation; Docker: BuildKit v0.11) -
Check builder and image-store behavior
If you expect provenance attestations, verify that the selected builder driver and image store support the behavior you rely on. Docker documents differences in attestation handling across builder drivers and image-store configurations (Docker: Build attestations).
-
Separate content differences from digest differences
If the digest differs, compare layers, filesystem contents, image configuration and metadata separately. The digest tells you the output is not byte-for-byte identical at the level being hashed; it does not, on its own, identify which input changed.
How cache can hide a changing dependency
Build cache can make two builds appear to use the same process when they did not execute the same instructions. For example, one build may reuse a cached package-install layer while another runs the command against a newer repository state. Conversely, a changed input does not necessarily trigger a cache miss: Docker documents that secret contents are not included in the cache checksum (Docker: Cache invalidation).
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →When comparing builds, inspect the build logs and cache status for relevant instructions. Treat a cache hit as evidence that the instruction was reused, not proof that an external source would return the same content if fetched again.
Controls that make future builds more repeatable
- Pin base images by digest rather than relying only on mutable tags.
- Use lockfiles, explicit dependency versions, versioned repositories or snapshots where available, and verify downloaded artifacts.
- Keep the target platform, build arguments, Dockerfile frontend and builder configuration consistent.
- Set a consistent
SOURCE_DATE_EPOCHwhen stable timestamps matter, accounting for its effect on cache reuse. - Record provenance and output digests in CI so a later comparison includes the resolved inputs, not only the source commit. Attestation availability depends on the builder and image-store setup.
What reproducibility studies show
A 2026 study, It’s Not Just Timestamps: A Study on Docker Reproducibility, reported that 78.7% of buildable Dockerfiles in its sample remained non-reproducible, and that infrastructure changes improved bitwise reproducibility by 18.6%. These are results for that study’s sample and experimental setup—not a universal failure rate for Docker builds (study).
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
