Definitely docker (well, let's say containers) control the library version, if you didn't build the image specifically not to do that (e.g. fetching dependencies at runtime, which is generally a bad practice and not the default).

However, at build time if you use things like "apt install …" You will get different versions depending on when you build the image, but once the image is built, you have always the same software inside. Obviously it is very different from nix as they serve very different purposes (one day I will find the motivation to switch to nixOS!).