No internet access during builds, no timestamps on anything, well defined compiler/linker options, sandboxed filesystem preferably

This is just things I know Nix does to their build sandbox but it's definitely not an exhaustive list.

Here's a good summary: https://reproducible-builds.org/docs/commandments/