I really like this idea, but I haven't seen anything from the docker side (using DockerHub) to enforce image tags being deterministic. Having a deterministic build doesn't get me all the way there if anyone can push over my tag with a different build manually.