In Wolfi's packaging system (melange) we setup a hermetic build environment. See here:

http://github.com/wolfi-dev/os

https://github.com/chainguard-dev/melange

We use this to build APK packages from source for a large set of software.