In Shellbox we're committing composer.lock and faking a platform in composer.json (see https://gerrit.wikimedia.org/r/649651). To make sure that the image matches what is being specified in composer.json, it is recommended to run composer check-platform-reqs: https://getcomposer.org/doc/03-cli.md#check-platform-reqs

I think this should be run after the composer install step.