This seriously needs to use the –require-hashes option to pip. Docker does not mean you can rebuild what you had before. Consider this a PSA, use hashes for EVERYTHING.
I’m trying to do something similar for flask
Please take a look and offer suggestions, issues, and pull requests.