The container
Both compilations run in one pinned container image, so the same source at the same commit gives the same two binaries anywhere.
The default
Without --host, the CLI starts the image named by TARE_IMAGE, mounts the repository, and runs the same command inside it. The image pins its Rust base by digest, the Agave release and platform tools by checksum, and its system packages by a dated snapshot.
Pinning an image
$ TARE_IMAGE=<repository>@sha256:<digest> tare build
A digest names one image for good. The toolchain version in a record tells tare check which one to rebuild with.
Building on the host
$ tare build --host
Uses Cargo and the platform tools installed on your machine. It is the quick loop while you work.