To provide a practical example of an attempt at creating a truly repeatable build consider the following -
A build pipeline which starts with a git repository for which no user can ever rewrite history or delete unmerged branches.
The first "build" step after checking out the source code is to spin up a container which contains all the build time dependencies.
The output of the build time container running is a container which contains the compiled binary.
More important to the repeatability of the build the following tags are added to the final container:
- The exact hash of the source code in the original repository and the url of both the git repo and a tar ball snapshot of the code that is uploaded to an artifact repository.
- The exact version of the build container that was used to run the build.
- The exact version of the original base image that the binary was loaded into.
- The values of all build-time variables used to create the binary.
- The version of docker that all three containers where built with as well as the version they where running under when they built.
By adding all of this meta data we can ensure that at any point in the future we can pull out the exact set of build dependencies (via the build container), compile the binary with an exact known set of steps (enshrined on the build container) and package this into another known base image with all run-time dependencies (using the base image tag) and this can all be based on the exact correct version of the source code based on the tag on the container.
Theoretically this should give us he ability to exactly reproduce a build version.
The importance of this is that it allows us to look at what's running in production and, even if everything has progressed versions significantly, go back and pull out the version of code, base image and build container originally used so that we can, for example, apply a hot fix to that version before rebuilding exactly as before so that we can redeploy knowing that it is exactly the same artifact with the only delta being the hot fix.