I have seen this many times, generally the high profile containers do that, and these issues are more common among my peers. This requires self discipline and containers were pushed as a panacea for environments where the discipline is lacking.

What is the point of storing the hash of an external file instead of checking the file into local version control? You're making it a part of your sources either way.

People who want to run docker don't want to run artifactory.

I'm not saying it's a good thing, but that's what I observed.

Do you have any examples of high-profile images that do this?

I really just haven't seen this with the ones I use.

Sorry, I see that my response looks ambiguous.

I meant the opposite. The high profile containers generally do the right thing, but containers created by peers rarely do it.

There's no mechanism to make things reproducible you need to implement it yourself, and from my experience most people (not the ones that release something publicly, but ones that work for a companies that use it) don't do it.