It's Not Just Timestamps: A Study on Docker Reproducibility

• URL: http://arxiv.org/abs/2602.17678v1
• Date: Tue, 03 Feb 2026 00:26:53 GMT
• Title: It's Not Just Timestamps: A Study on Docker Reproducibility
• Abstract summary: We build a Docker measurement pipeline and apply it to a sample of 2,000 GitHub repositories that contained a Dockerfile.<n>We found that only 56% produce any buildable image, and just 2.7% of those are bitwise reproducible without any infrastructure configurations.<n>We derive concrete Dockerfile guidelines from these patterns and discuss how they can inform future linters and Continuous Integration (CI) checks for reproducible containers.
• Score: 0.3553493344868413
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Reproducible container builds promise a simple integrity check for software supply chains: rebuild an image from its Dockerfile and compare hashes. We build a Docker measurement pipeline and apply it to a stratified sample of 2,000 GitHub repositories that contained a Dockerfile. We found that only 56% produce any buildable image, and just 2.7% of those are bitwise reproducible without any infrastructure configurations. After modifying infrastructure configurations, we raise bitwise reproducibility by 18.6%, but 78.7% of buildable Dockerfiles remain non-reproducible. We analyze the root causes of the remaining differences, and find that beyond timestamps and metadata, developer-controlled choices such as uncleaned caches, logs, documentation, and floating versions are dominant causes of non-reproducibility. We derive concrete Dockerfile guidelines from these patterns and discuss how they can inform future linters and Continuous Integration (CI) checks for reproducible containers.

Related papers

• Independent Patch Verification for Coding Agents with a Bidirectional Reconstruct-and-Verify Framework [49.16055123488827]
  coding agents powered by large language models can now generate code patches directly from bug reports.<n>No mechanism independently verifies whether it truly resolves the reported problem.<n>We propose RETRACE, a training-free post-generation verification framework.
  arXiv  Detail & Related papers  (2026-08-09T22:59:13Z)
• Taming the Drift: Context-aware Repair of Dockerfile Drift during Software Evolution [52.50730821321986]
  Cadre is a context-aware framework for automated Dockerfile drift repair.<n>CDG maps each Dockerfile instruction to its file-level and inter-instruction dependencies.<n>DodeX mines real-world Dockerfile drift instances from GitHub Actions CI logs.
  arXiv  Detail & Related papers  (2026-07-14T09:12:26Z)
• Beyond the Tip of the Iceberg: Understanding SATD in Dockerfiles through the Lens of Co-evolution [10.059038321113546]
  We study self-admitted technical debt (SATD) in Dockerfiles alongside the related source code.<n>We find that approximately 27% of admission events and 40% of repayment events are coupled to non-Dockerfile artifacts.
  arXiv  Detail & Related papers  (2026-05-20T14:26:56Z)
• WildClawBench: A Benchmark for Real-World, Long-Horizon Agent Evaluation [88.10947115397971]
  This work presents WildClawBench, a native-runtime benchmark of 60 human-authored, bilingual, multimodal tasks spanning six thematic categories.<n>Each task averages roughly 8 minutes of wall-clock time and over 20 tool calls.<n> Grading is hybrid, combining deterministic rule-based checks, environment-state auditing of side effects, and an LLM/VLM judge for semantic verification.
  arXiv  Detail & Related papers  (2026-05-11T17:49:43Z)
• Analyzing the Availability of E-Mail Addresses for PyPI Libraries [89.21869606965578]
  81.6% of libraries include at least one valid e-mail address, with PyPI serving as the primary source.<n>We identify over 698,000 invalid entries, primarily due to missing fields.
  arXiv  Detail & Related papers  (2026-01-20T14:54:58Z)
• RepoGenesis: Benchmarking End-to-End Microservice Generation from Readme to Repository [52.98970048197381]
  RepoGenesis is the first multilingual benchmark for repository-level end-to-end web microservice generation.<n>It consists of 106 repositories (60 Python, 46 Java) across 18 domains and 11 frameworks, with 1,258 API endpoints and 2,335 test cases verified.<n>Results reveal that despite high AC (up to 73.91%) and DSR (up to 100%), the best-performing system achieves only 23.67% Pass@1 on Python and 21.45% on Java.
  arXiv  Detail & Related papers  (2026-01-20T13:19:20Z)
• Toward Automated Test Generation for Dockerfiles Based on Analysis of Docker Image Layers [1.1879716317856948]
  The process for building a Docker image is defined in a text file called a Dockerfile.<n>A Dockerfile can be considered as a kind of source code that contains instructions on how to build a Docker image.<n>We propose an automated test generation method for Dockerfiles based on processing results rather than processing steps.
  arXiv  Detail & Related papers  (2025-04-25T08:02:46Z)
• Doctor: Optimizing Container Rebuild Efficiency by Instruction Re-Orchestration [11.027705516378875]
  We present Doctor, a method for improving Dockerfile build efficiency through instruction re-ordering.<n>We developed a dependency taxonomy based on Dockerfile syntax and a historical modification analysis to prioritize frequently modified instructions.<n>Experiments show Doctor improves 92.75% of Dockerfiles, reducing rebuild time by an average of 26.5%, with 12.82% of files achieving over a 50% reduction.
  arXiv  Detail & Related papers  (2025-04-02T13:53:35Z)
• Refactoring for Dockerfile Quality: A Dive into Developer Practices and Automation Potential [0.0]
  This paper explores the utility and practicality of automating Dockerfile using 600files from 358 open-source projects.<n>Our approach leads to an average reduction of 32% in image size and a 6% decrease in build duration, with improvements in understandability and maintainability observed in 77% and 91% of cases.
  arXiv  Detail & Related papers  (2025-01-23T23:10:47Z)
• Dockerfile Flakiness: Characterization and Repair [6.518508607788089]
  We present the first comprehensive study of Dockerfile flakiness, featuring a nine-month analysis of 8,132 Dockerized projects.<n>We propose a taxonomy categorizing common flakiness causes, including dependency errors and server connectivity issues.<n>We introduce FLAKIDOCK, a novel repair framework combining static and dynamic analysis, similarity retrieval, and an iterative feedback loop powered by Large Language Models.
  arXiv  Detail & Related papers  (2024-08-09T23:17:56Z)
• On the Security Blind Spots of Software Composition Analysis [46.1389163921338]
  We present a novel approach to detect vulnerable clones in the Maven repository. We retrieve over 53k potential vulnerable clones from Maven Central. We detect 727 confirmed vulnerable clones and synthesize a testable proof-of-vulnerability project for each of those.
  arXiv  Detail & Related papers  (2023-06-08T20:14:46Z)
• DRIVE: Dockerfile Rule Mining and Violation Detection [6.510749313511299]
  A Dockerfile defines a set of instructions to build Docker images, which can then be instantiated to support containerized applications. Recent studies have revealed a considerable amount of quality issues with Dockerfiles. We propose a novel approach to mine implicit rules and detect potential violations of such rules in Dockerfiles.
  arXiv  Detail & Related papers  (2022-12-12T01:15:30Z)
• CropMix: Sampling a Rich Input Distribution via Multi-Scale Cropping [97.05377757299672]
  We present a simple method, CropMix, for producing a rich input distribution from the original dataset distribution. CropMix can be seamlessly applied to virtually any training recipe and neural network architecture performing classification tasks. We show that CropMix is of benefit to both contrastive learning and masked image modeling towards more powerful representations.
  arXiv  Detail & Related papers  (2022-05-31T16:57:28Z)
• Repro: An Open-Source Library for Improving the Reproducibility and Usability of Publicly Available Research Code [74.28810048824519]
  Repro is an open-source library which aims at improving the usability of research code. It provides a lightweight Python API for running software released by researchers within Docker containers.
  arXiv  Detail & Related papers  (2022-04-29T01:54:54Z)
• D2A: A Dataset Built for AI-Based Vulnerability Detection Methods Using Differential Analysis [55.15995704119158]
  We propose D2A, a differential analysis based approach to label issues reported by static analysis tools. We use D2A to generate a large labeled dataset to train models for vulnerability identification.
  arXiv  Detail & Related papers  (2021-02-16T07:46:53Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.