The magic of the Dockerfile is that it puts the onus of spelling out the environment dependencies on the maintainer, not the user. This was always the case but the difference is now its an easily verifiable, non-binary file.

Layering is as much an abstraction paradigm as a performance one. Its not trivial to verify every loose bootstrap script or .deb that would be needed to build a sandbox... But in a Dockerfile you can see its just some official alpine image base, and a few added files and an entrypoint.