Dockerfile, Docker image and reproducible environment

The usual documentation and notes on docker mention version controlling and sharing the **Dockerfile**, which should let anyone build an identical image. This sounds great, however, we typically have commands like this one. RUN apt-get update pip install.. Which could install different things/versions/patches based on the time of the run and make debugging difficult. On the other hand, sharing docker images does not give you benefits like version control and seeing what's exactly different between two images. - Which of these (dockerfile vs image) is supposed to be the reference to use for development and deployment? - Should the Dockerfile instead have more details on exact updates? even then the base image might be different based on when you are running it.