You can absolutely build a reproducible image in Dockerfile if you have discipline and follow specific patterns of doing.
But you can achieve the same result if you use similar techniques with a bash script.
But you can achieve the same result if you use similar techniques with a bash script.
Just create a snapshot of the OS repo, so apt/dnf/opkg/ etc will all reproduce the same results.
Make sure _any_ scripts you call don't make web requests. If they do you have the validate the checksums of everything downloaded.
Have no way to be sure that npm/pip/cargo's package build scripts are not actually pulling down arbitrary content at build time.
You seem to be comparing 2 different things.
There are still ways that package will not be fully reproducible, for example if it uses rand() during build, Nix doesn't patch that, but stuff like that is fortunately not common.