I think Nix does a pretty good job at this. I've used it on Ubuntu, macOS and NixOS (with the latter two sharing the same system config, with OS-specific pieces

I think Nix does a pretty good job at this. I've used it on Ubuntu, macOS and NixOS (with the latter two sharing the same system config, with OS-specific pieces tucked into if/else expressions). I think of Nix more as a build system than a package manager (and in fact I've come to think of "package managers" as a sub-set of build systems, mostly used to work around deficiencies in Make which make it unsuitable for building whole operating systems via composition of their Makefiles). One thing that Nix emphasises is that users should not be installing dependencies, like libraries; let alone in a globally visible, ambiguous location like '/usr/lib' (or /usr/bin, etc. if it's a tool that we're depending on). Dependencies are only needed 'ambiently' in a package's build environment; build products can embed references those by absolute path if they like, but they shouldn't be 'propagated' into the final system.