Builds

What makes a build reproducible, and why would you care?

Whether the candidate can enumerate the inputs a build depends on, including the ones that are invisible.

The situation behind the question

A Dockerfile starts FROM node:20, runs apt-get install without pinned versions, and npm install without a committed lockfile. A build from an unchanged commit last week produced an image 60 MB larger than the one from the month before, and nobody can explain the difference.