一句话：通过 2000 个 GitHub 仓库的大规模测量，揭示 Docker 构建不可复现的规模与开发者可控根因，并提出 Dockerfile 规范建议。
可复现构建被视为软件供应链的一种简单完整性校验：从 Dockerfile 重建镜像并比较哈希。本文构建了一套 Docker 测量流水线，对 2,000 个含 Dockerfile 的 GitHub 仓库进行分层采样与构建实验，检验其位级可复现性。结果显示，只有 56% 的仓库能构建出镜像，而在可构建者中仅 2.7% 在默认基础设施配置下位级可复现；修改基础设施配置可将位级可复现率提高 18.6%，但仍有 78.7% 的可构建 Dockerfile 不可复现。作者进一步分析残余差异的根因，发现除时间戳与元数据外，未清理的缓存、日志、文档以及浮动版本等开发者可控选择是主要来源，并据此提炼出具体的 Dockerfile 编写准则，为未来的 linter 与 CI 检查提供依据。
Reproducible container builds promise a simple integrity check for software supply chains: rebuild an image from its Dockerfile and compare hashes. We build a Docker measurement pipeline and apply it to a stratified sample of 2,000 GitHub repositories that contained a Dockerfile. We found that only 56% produce any build-able image, and just 2.7% of those are bitwise reproducible without any infrastructure configurations. After modifying infrastructure configurations, we raise bitwise reproducibility by 18.6%, but 78.7% of buildable Dockerfiles remain non-reproducible. We analyze the root causes of the remaining differences, and find that beyond timestamps and metadata, developer-controlled choices such as uncleaned caches, logs, documentation, and floating versions are dominant causes of non-reproducibility. We derive concrete Dockerfile guidelines from these patterns and discuss how they can inform future linters and Continuous Integration (CI) checks for reproducible containers.