Our nightly patch build reused one cached apt-get upgrade for seven months

<p>Our services run on a base image of our own, built from Ubuntu 22.04. In March we pinned the Ubuntu image by digest, so that two builds of the same commit would always start from the same bytes, and we kept security patches flowing with one line near the top of the Dockerfile:</p> <p>RUN apt-get update &amp;&amp; apt-get -y upgrade &amp;&amp; rm -rf /var/lib/apt/lists/*</p> <p>A scheduled workf

Read the source →