Arch Linux now provides bit-for-bit reproducible Docker images

Arch Linux provides bit-for-bit reproducible Docker images. This extends to Docker the reproducibility milestone achieved for WSL images a few months ago.

• Images are distributed under a dedicated repro tag.
• To ensure reproducibility, the pacman keys have been removed from the default state, so pacman cannot be used right away.
• To install or update packages, you must first regenerate the keyring with pacman-key --init && pacman-key --populate archlinux.

Reproducibility is verified through digest matching across builds and comparison with diffoci. The reproduction procedure is documented in REPRO.md, and it can be verified using methods like podman inspect --format '{{.Digest}}' <image>.

On the implementation side, the base rootFS for Docker was built deterministically, with the following adjustments applied:

• Setting SOURCE_DATE_EPOCH and aligning the org.opencontainers.image.created label
• Removing var/cache/ldconfig/aux-cache to eliminate non-determinism
• Using --source-date-epoch and --rewrite-timestamp with docker build / podman build

Going forward, the plan is to introduce a rebuilder for Docker images, WSL images, and future reproducible images, enabling periodic automatic rebuilds, verification, and publishing of logs and results.