Any Dockerfile you like, built against a context you control, with every layer open to inspection. No gates, no par, no record kept. It arrives with the builder, because until then there is nothing to play with.

Lands in M2.