Platform & DevOps·Packaging: containers and images
the build runs with the network switched off, so anything it needs had to be declared up front.
Hermetic build
Also calledsealed build, sandboxed build
A build isolated from anything not explicitly declared as an input: no ambient network access, no reliance on tools that happen to be on the machine. It is the precondition for reproducibility and for meaningful provenance, because a build that can reach the internet mid-run can pull in anything. Making a build hermetic is usually a painful audit of everything it was implicitly depending on, and the audit is the point.