The content address of a docker image is a json blob (referencing other objects).
The content address of a Dockerfile "RUN" command is the content address of what came before it and the command being run.
In the case of Nix it's addressed by the input. Not the content of the build. It's an important distinction and one Nix also makes.
https://nixos.org/manual/nix/stable/command-ref/new-cli/nix3...
But doing this is going to give you a slight headace as most of the package repository in Nix is not checked for reproducible builds and there are no way to guarantee the hashes are actually static.
We are saying the same thing here, I'm just trying to point out this is exactly how docker build works, but rather it is more about what you are willing to put into your docker build.