dockfixup at play, most likely.
https://medium.com/@opragel/how-to-customize-stop-dockfixup-on-macos-f349cd3c7b15

Dockfixup is among a handful of issues plaguing High Sierra that Apple has yet to fix (unless you flood them with 1000s of posts/emails).

See my fight and unconventional fix here:

https://www.jamf.com/jamf-nation/discussions/25577/com-apple-dockfixup-plist-and-high-sierra

Basically use AutoDMG to install a replacement dockfixup on the Mac (System/Library/CoreServices/Dock.app/Contents/Resources/com.apple.dockfixup.plist) when it is not loaded (thus avoiding SIP which protects dockfixup from being edited normally). Once that is done use an edited to your liking com.apple.dock.plist in the user template, done.

@Cornoir What does your replacement dockfixup.plist look like? Can the contents of it just be deleted? If so, then I think I can reduce the phenomenal nightmare of dock management to a two step process:

1. Replace dockfixup.plist
2. Replace com.apple.dock.plist in User Template.

I can probably skip all the broken-jamf-dock-items-payload, dockutil, etc. convolutedness.

I don't do anything with dockfixup, my method is working fine on both 10.13 and 10.14. Timing is crucial with the Dock. A LaunchAgent calls the script.

#!/bin/bash

breadcrumb="$HOME/Library/Preferences/org.company.dockbuilder.plist"
log="$HOME/Library/Logs/DockBuilder.log"
scriptName=$(basename "$0")
icon="/Applications/Utilities/DockBuilder.app/Contents/Resources/appIcon.icns"

# Array to hold all the items we need to add
# Note: if you need to add options you must seperate the item from the options with a @ symbol
# Example: "'/Library/Connect to...'@--view list --display folder --sort name"
declare -a itemsToAdd=(
    "/Applications/System Preferences.app"
    )

function writelog () {
    DATE=$(date +%Y-%m-%d %H:%M:%S)
    /bin/echo "${1}"
    /bin/echo "$DATE" " $1" >> "$log"
}

function finish () {
    kill "$jamfHelperPID" 2>/dev/null; wait "$jamfHelperPID" 2>/dev/null
    writelog "======== Finished $scriptName ========"
    exit "$1"
}

function modify_dock () {
    for item in "${itemsToAdd[@]}"; do
        if [[ "$item" =~ @ ]]; then
            params=${item##*@}
            item=${item%@*}
            /usr/local/bin/dockutil --add "$item" $params --no-restart "$HOME/Library/Preferences/com.apple.dock.plist" 2>&1 | while read -r LINE; do writelog "$LINE"; done;
        else
            /usr/local/bin/dockutil --add "$item" --no-restart "$HOME/Library/Preferences/com.apple.dock.plist" 2>&1 | while read -r LINE; do writelog "$LINE"; done;
        fi
    done
}

create_breadcrumb () {
    # Create a breadcrumb to track the creation of the Dock
    writelog "Creating DockBuilder user breadcrumb."
    /usr/bin/defaults write "$breadcrumb" build-date "$(date +%m-%d-%Y)"
    /usr/bin/defaults write "$breadcrumb" build-time "$(date +%r)"
}

writelog " "
writelog "======== Starting $scriptName ========"

# Make sure DockUtil is installed
if [[ ! -f "/usr/local/bin/dockutil" ]]; then
    writelog "DockUtil does not exist, exiting."
    finish 1
fi

# We need to wait for the Dock to actually start
until [[ $(pgrep -x Dock) ]]; do
    wait
done

# Check to see if the Dock was previously set up for the user
if [[ -f "$breadcrumb" ]]; then
    writelog "DockBuilder ran previously on $(defaults read "$breadcrumb" build-date) at $(defaults read "$breadcrumb" build-time)."
    finish 0
fi

# Display a dialog box to user informing them that we are configuring their Dock (in background)
/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper -windowType utility -title "DockBuilder" -icon "$icon" -description "Your Mac's Dock is being built for the first time." &
jamfHelperPID=$!

# Hide the Dock while it is being updated
/usr/bin/defaults write "$HOME/Library/Preferences/com.apple.dock.plist" autohide -bool TRUE
/usr/bin/killall Dock
/bin/sleep 2

writelog "Clearing Dock."
/usr/local/bin/dockutil --remove all --no-restart "$HOME/Library/Preferences/com.apple.dock.plist" 2>&1 | while read -r LINE; do writelog "$LINE"; done;
/bin/sleep 5

# Add the items to the Dock
writelog "Adding items to Dock."
itemsToAdd+=("/Applications/Self Service.app/")
itemsToAdd+=("/Applications/Safari.app/")
itemsToAdd+=("/Applications/Google Chrome.app/")
itemsToAdd+=("/Applications/@--view grid --display stack --sort name")
itemsToAdd+=("$HOME/Downloads")

modify_dock
create_breadcrumb

# Reset the Dock and kill the jamfHelper dialog box
writelog "Resetting Dock."
/usr/bin/defaults write "$HOME/Library/Preferences/com.apple.dock.plist" autohide -bool FALSE
/usr/bin/killall Dock

finish 0

I saw this note on the page discussing docfixup.plist:

Edit II (2017–11–29): Overdue update! This has not been working with macOS 10.12.6 and beyond when last tested by myself and others. As always, test before deploying changes and let me know if you’ve succeeded in 10.13 or beyond on macadmins.slack.com.

@hendersond - This is my dock wipe script for provisioning mojave machines. Works fine. Runs after login though. It's apart of our DEPnotify setup.

#!/bin/bash

DOCKUTIL_BINARY="/Path/To/dockutil"

# Removal of Apple Default Dock Applications
#########################################################################################

$DOCKUTIL_BINARY --remove 'Siri' --allhomes

$DOCKUTIL_BINARY --remove 'Launchpad' --allhomes

$DOCKUTIL_BINARY --remove 'Safari' --allhomes

$DOCKUTIL_BINARY --remove 'Mail' --allhomes

$DOCKUTIL_BINARY --remove 'Contacts' --allhomes

$DOCKUTIL_BINARY --remove 'Calendar' --allhomes

$DOCKUTIL_BINARY --remove 'Notes' --allhomes

$DOCKUTIL_BINARY --remove 'Reminders' --allhomes

$DOCKUTIL_BINARY --remove 'Maps' --allhomes

$DOCKUTIL_BINARY --remove 'Photos' --allhomes

$DOCKUTIL_BINARY --remove 'Messages' --allhomes

$DOCKUTIL_BINARY --remove 'FaceTime' --allhomes

$DOCKUTIL_BINARY --remove 'iTunes' --allhomes

$DOCKUTIL_BINARY --remove 'iBooks' --allhomes

$DOCKUTIL_BINARY --remove 'App Store' --allhomes

$DOCKUTIL_BINARY --remove 'News' --allhomes

same thing to add

#!/bin/bash

# Configures Default Dock
#########################################################################################

DOCKUTIL_BINARY="/Library/Path/To/dockutil"

# Addition of 21CCCS Dock Applications for Technology Department
#########################################################################################

$DOCKUTIL_BINARY --add /Applications/Utilities/Script Editor.app

$DOCKUTIL_BINARY --add /Applications/Utilities/Disk Utility.app

$DOCKUTIL_BINARY --add /Applications/Utilities/Console.app

$DOCKUTIL_BINARY --add /Applications/Utilities/Terminal.app

@ryan.ball I tried your script, and it works great on first run. However, if I go back into the script and edit it to add/remove/shift apps in the list, then log back into the machine with the same user account, it doesn't update per the new parameters. It appears that the "breadcrumb" file left behind blocks the script from running fully again. However, even when I've deleted that file and login again, the dock remains the same.

What might I be missing?

The breadcrumb keeps the script from running again on the user. I don't want to rebuild the user's dock every login as I'd like them to be able to modify it after I set it initially. If you want it to run every login you'd need to maybe comment out this section to test, and then clean up the pieces related to the breadcrumb.

# if [[ -f "$breadcrumb" ]]; then
#     writelog "DockBuilder ran previously on $(defaults read "$breadcrumb" build-date) at $(defaults read "$breadcrumb" build-time)."
#     finish 0
# fi

Did you configure a LaunchAgent to run the script?

I'll try your suggestion and let you know how it goes. The script is triggered using a Jamf policy at login. On our classroom machines, the user's directory is deleted after they logout, so every time they login they have a fresh folder in the /Users/ directory.