Tern is designed to help with this sort of thing: https://github.com/tern-tools/tern#dockerfile-lock

It can take a Dockerfile and generate a 'locked' version, with dependencies frozen, so you at least get some reproducibility.

Disclaimer work for VMware; but on a different team.