I agree that Docker doesn't do the best job here, you can still get a lot better reproducibility than without though. You can use specific image hashes to work

I agree that Docker doesn't do the best job here, you can still get a lot better reproducibility than without though. You can use specific image hashes to work around image tag changes. For problem 2 ideally use something like NixOS as a base or at least nix package manager. But IMO Nix is quite complicated, even though the working model is really good. So this is mostly if you really need deterministic builds. Docker already gets you 80% of the way with 20% of the effort.