It depends a lot on your base image. If you use Debian locked to a release, you'll likely get the same Apache version plus small fixes / security fixes (whateve

It depends a lot on your base image. If you use Debian locked to a release, you'll likely get the same Apache version plus small fixes / security fixes (whatever the exact Debian policy is). That's not reproducible in the sense of "reproducible software", but it is usually good enough to build other things on top of. If you want reproducible in the sense of unchaging/same digest, you should make a custom base image with the things you never want to change and pull it from somewhere.