CNAB makes reproducibility possible by providing unified lifecycle management, packaging, and distribution. Of course if bundle authors don't take care to work around problems with imperative logic, that's a risk. In practice, we see declarative models for building bundles offer more reproducibility.

For example, see how you can build a CNAB using a Terraform base image: https://github.com/deislabs/bundles/tree/master/terraform