The Debian testing/trixie release on amd64 is now reproducible for over 95% (micronews.debian.org)

No internet access during builds, no timestamps on anything, well defined compiler/linker options, sandboxed filesystem preferably

This is just things I know Nix does to their build sandbox but it's definitely not an exhaustive list.

Here's a good summary: https://reproducible-builds.org/docs/commandments/