As always, excellent hacking Martin! You may find some of these utility functions handy to generate the Dockerfile:
(of course, your project is shell only and so probably doesn’t need to use an OCaml library for this)
One thing that we’ve found useful for reproducible and cacheable Dockerfiles is to specify revisions of opam-repo explictly rather than just opam init. If you specify an exact git checkout, it’ll reliably rebuild the Dockerfile when you update that hash.