We are doing something similar at work, specifying exact few dependencies needed on the host and their versions (mostly docker, tar etc), then we make a chroot

We are doing something similar at work, specifying exact few dependencies needed on the host and their versions (mostly docker, tar etc), then we make a chroot environment using debootstrap from known few packages and versions, from this we make a docker image (tar cf - chroot | docker import) and use this as base for build environment. We could use pacstrap or whatever too, the initial selection of packages is important. For any package which we need to build, we have many packages with dependencies between them, are specified in a Makefile - because make is good at dependency tracking, but when make needs to (re)-build a package, it does so using the docker build-container-base image, whatever that package does is committed for later analysis under the name of the package built and timestamp, for traceability. For every package built, the resulting docker image, with build-environment-and-package-plus-timestamp name, is run but now, trying to install the package and commit that image as well with 'install' tag. - so we also verify the install step basically. Btw, this is for openstack, many components, packages and dependencies all over the place.