Note that ”Nix code” also includes the hashes of all non-Nix sources. One way to think of it is that Nix has reliable build cache invalidation.

> This is more/less what people hope Dockerfiles provide.

Indeed, but importantly they do not provide input-reproducibility (while Nix does) because, at least, there are no hashes for remote data.