> It should be safe to assume that Dockerfile create the same (or really similar) image everytime

Nope. Most of the Dockerfiles I've seen will do wildly-unreproducible things, like running apt/pip/yum/npm/mvn/sbt/etc. without even giving any version numbers (let alone expected hashes)

This seems to be pretty rampant; for example, here's some AWS documentation which encourages such reckless behaviour (even giving the '-y' option to apt-get!): https://docs.aws.amazon.com/AmazonECS/latest/developerguide/...