Determinism of layer identifiers

[0xf965]

Hi,

I understand that the DiffId is the hash of the unzipped layer, and that it is independent of the image,
but, at least in Docker, every time I build the same image, different DiffId are obtained.

Should they be deterministic?

Am I doing or assuming something wrong?

If they are not, why not?

Thanks.

[vbatts]

something like docker build --no-cache will have different DiffId's, just for the virtue of timestamps and compiles. This kind of reproducible builds has been historical effort, but is not what we're attempting to solve. Tools like docker do attempt to do some minor reproducible pieces. But as to how different compilers or tools generate the contents of the container, that is not-trivial to solve.

The big determinism is once a layer is built. That unpacking and repacking of the same content is deterministic. Compression can and does mess this up, but at least for the *.tar itself, this should hold true.