Docker builds are not deterministic. If you build an image twice with the same exact same contents, it may produce a different hash each time. (While not directly relevant, we wanted to note this unexpected observation. As a corner case, consider that a freshly built large layer that is identical to a layer already in the registry may still get uploaded as a new layer.)

Nix actually fixes this with dockerTools.buildImage.

A bit surprised pex is still working and maintained, we used and loved it at a former company ca. 2014-2017 and it solved all our python packaging issues but it didn’t seem to be too popular overall.

Too bad it’s just python