If you want repeatable builds you got to pin your discourse version to a specific sha via your container config, and every plugin
That means you stop getting fixes to discourse, security fixes to docker image and so on, but the build will be pretty repeatable
You may need to amend templates as well to fossilise stuff and never take in security fixes to apt dependencies