[mickeyp]

But you can already do this.

FROM myregistry.example.com/foo:1.2.3@sha256:<hash>

You can call `docker build --network=none` to disable network access during the build step.

Why would you make a lock file from a Dockerfile? You can specify everything inside it already; from the version you pull with yum to explicitly COPY'ing RPMs/debs you keep locally.