I'm trying to build and I'm not getting reproducible images. This is the buildx command I'm using:

docker buildx build -o type=oci,dest=image.img,rewrite-timestamp=true -f Dockerfile.debian-12 --platform linux/amd64 --no-cache --build-arg SOURCE_DATE_EPOCH=1675298208 .

Could there be an example buildx invocation in the README to help someone use this strategy?

Hi! Thanks for your great work :)

The README mentions

# SOURCE_DATE_EPOCH is set to 1691114774 (i.e., 20230804T020614Z, timestamp of /etc/apt/sources.list)
FROM ubuntu:jammy-20230804
ENV DEBIAN_FRONTEND=noninteractive
RUN \
  --mount=type=cache,target=/var/cache/apt,sharing=locked \
  --mount=type=cache,target=/var/lib/apt,sharing=locked \
  --mount=type=bind,source=./repro-sources-list.sh,target=/usr/local/bin/repro-sources-list.sh \   # <-- THIS LINE HERE
  repro-sources-list.sh && \
  apt-get update && \
  apt-get install -y gcc

What do you think about showing an example Dockerfile that fetches /repro-sources-list.sh?

I'm thinking this repo could be maintaining a docker image that only contains the script in a scratch image. This could make the setup even simpler:

# SOURCE_DATE_EPOCH is set to 1691114774 (i.e., 20230804T020614Z, timestamp of /etc/apt/sources.list)
FROM ubuntu:jammy-20230804
ENV DEBIAN_FRONTEND=noninteractive
RUN \
  --mount=type=cache,target=/var/cache/apt,sharing=locked \
  --mount=type=cache,target=/var/lib/apt,sharing=locked \
  --mount=from=reproducible-containers/repro-sources-list.sh:v1@sha256:...,type=bind,source=/repro-sources-list.sh,target=/usr/local/bin/repro-sources-list.sh \   # <-- THIS LINE HERE
  repro-sources-list.sh && \
  apt-get update && \
  apt-get install -y gcc

The scratch image Dockerfile could be:

# Tag as reproducible-containers/repro-sources-list.sh:v1
FROM scratch
COPY ./repro-sources-list.sh /

Thoughts?

As the examples here in the repo suggest, one can/should pin Ubuntu and Debian images using a date tag, e.g.

FROM ubuntu:jammy-20230804
# or
FROM debian:bookworm-20230904-slim

However, those images only get published occasionally, which causes problems the second a vulnerability gets reported in some package and an update to a package version published after the given date 20230904 is needed.

Is it possible to have repo-sources-list.sh set a more recent snapshot date, independently of the Ubuntu/Debian image tag? In other words, the base image would be e.g. debian:bookworm-20230904-slim but the repo sources would then get set to, say, the 2024-04-07 snapshot from snapshot.debian.org. Of course, this would trigger lots of upgrades during apt-get update && apt-get upgrade later but that is fine / is actually the point.