thats not entirely true. I’d have to go dig and find out the specifics but you can shove plugins in /usr/share/jenkins/ref/plugins/ and that will copy over (without replacing) into $JENKINS_HOME/plugins
So, you could update your entrypoint to delete $JENKINS_HOME/plugins every startup
I use helm which has a flag to delete the contents of the directory, but my docker image has all the plugins in the ref directory
(ignore the env CASC_HOME as helm overrides it, and i was just lazy to remove that line from the docker file)