Looks like Nix could be great for this. Here's a blog post with an example: https://mitchellh.com/writing/nix-with-dockerfiles
Of course, the trade-off is having to learn at least the basics of Nix, but looks like a great investment considering the benefits.
Hurry up before the next right-wing government fires everyone involved and orders a total rollback.