Composer generated installation can't be completely cloned
This is perfectly explain on https://getcomposer.org/doc/faqs/should-i-commit-the-dependencies-in-my-vendor-directory.md

In short, that's because git kind of treats folders with a .git as submodules.

The composer.lock file exists to be able to re-install an exact copy with the same commits of dependencies and so on. Or another option is building .tar.gz, containers or similar packages that can be used for efficient deployments.