Should key be generated during image build?

No, because the key is used for various encryption tasks, so if you change it and redeploy your app, things like existing sessions will immediately become invalid since they won't be decryptable.

Then I need to do a clean init (key:generate, passport:keys ..etc) once and copy it to the env and pass it back to container .env? I'm quiet confusing about this.

My app is update frequently except the env