It's pretty hard to do truly declarative/immutable things with docker because the typical dockerfile starts with "apt-get update && apt-get install ...". For that use case I think nix is much better.
That's what I tried doing. The result was that the docker container didn't build anymore because at least one of the packages we used had a a patch release every other day and apt only serves the most up to date version.
