[pmoriarty]

"a dockerfile seems so useful for having an easily readable declaration of what exactly is inside the container"

I wish this was the case, but unfortunately it doesn't tell you what's in the base/parent image.

It also doesn't ensure you get bit-exact reproduceable builds. You need something like Guix/Nix for that.