When to Use a Dockerfile vs a Bash Script for Setup?

I'm trying to figure out the best practices for setting up installations in Docker. I know that the general guideline is to keep your Dockerfile efficient by minimizing the number of layers you create, as there's a limit of 127 layers. However, I'm also considering whether to include more complex operations in a separate bash script once the Dockerfile has done its initial work, especially when needing to install packages that aren't available through apt-get or when I have to add GPG keys and custom source lists.

For instance, I often have to create directories, clone repositories, and manage certificates—all of which might be cumbersome if placed in the Dockerfile, especially since they could lead to outdated images. The downside is that overloading a bash script can delay container startup times.

So, I'm looking for advice on what should ideally go in the Dockerfile versus what would be better suited for a bash script that runs at container startup. For example, if I want to install the Bitwarden Secrets CLI, should I embed that in the Dockerfile to have a fixed version or run it from a script to always get the latest version?