Container Image
A layer is a changeset, not a snapshot. Removals are recorded as entries, which is why a deleted credential still ships.
-
-
Reproducible Build
Timestamps, locale, build path, and map iteration order are enough to make two builds of one commit differ. None of them is in your code.