Deterministic builds

[calind]

I'm trying to build deterministic docker images. The problem I'm currently facing is that I don't know what portage snapshot or git commit was used for building the stage3 image. Is there a way to reliably determine that?

[javabrett]

If I understand correctly, you want to be able to:

• Build your own stage3 Docker image from the Dockerfiles maintained in this project.
• Be able to determine which exact stage3 and portage snapshots the image is built-from.
• If necessary, be able to rebuild that image.

I suspect that is going to require some changes in the current files.

• https://github.com/gentoo/gentoo-docker-images/blob/master/portage.Dockerfile#L13 allows for ARG SNAPSHOT but it defaults to portage-latest.tar.xz and the value isn't recorded anywhere. It could be added as a LABEL. If you allow latest portage-latest.tar.xz you'd need to be satisfied that you could extract the right metadata from it, and do that.
• https://github.com/gentoo/gentoo-docker-images/blob/master/stage3.Dockerfile#L22 reads the latest STAGE3PATH by reading the hosted text file. That could be added as an ARG and/or a LABEL.