1. Is runtimeClasspath (the main source set's runtime classpath) the correct and canonical configuration to inspect when answering "what gets deployed to production" for an application-plugin + installDist + Docker setup?

Actually, that's hard to say generically. Any plugin you apply or any build script can change the configuration of what is actually deployed. But in a plain standard setup, you are right that

runtimeClasspath

is, what is used by the application plugin by default. You should though probably not parse the

dependencies

task output, it's not really made for parsing, but human consumption.

2. Are there any edge cases where installDist/distTar/distZip would include jars not in runtimeClasspath, or exclude jars from runtimeClasspath? (e.g. configurations like runtimeOnly, developmentOnly, custom dependencies added to applicationDistribution, etc.)

Yes, possible.l, depending on the plugins you apply and the configuration you do.

3. Is there a more idiomatic Gradle command we should be using to answer this question — for example, inspecting the actual output of installDist directly, or some configuration like mainRuntimeClasspath that I'm not aware of?

Really heavily depends on your build. You could theoretically also configure

installDist

,

distZip

, and

distTar

differently, even though by default they all use then main distribution copy spec. So if this is high security relevant, you might want to compare the actual packed files with the resolved dependencies or something. 🤷‍♂️

Thank you for answer 🙂