Dockerfile: Use apt-get or apt-cache Instead of apt

The apt command is interactive-oriented and less stable for scripts. Use apt-get or apt-cache in Dockerfiles for deterministic, non-interactive package steps.

This page describes a highlighted problem produced by the Docker and Kubernetes Security scanner plugin.

You could find more details on the internal page: Cloud (IaC) Security plugin

If this project has been helpful to you, please consider giving it a ⭐ on GitHub to help others discover it.

Problem

Using apt in a Dockerfile can cause unpredictable behavior. apt is meant for end-user operations, not for scripting.

Description

apt provides a user-friendly interface intended for interactive sessions. In automated container builds, command behavior and output stability matter more than interactive convenience, so apt-get/apt-cache are safer script-oriented choices.

Using script-stable package commands reduces CI variability, simplifies troubleshooting, and keeps build logs predictable. It also aligns with common hardening guidance for Dockerfiles that require deterministic package-management steps.

Related rules: combine update and install in one RUN, use –no-install-recommends, use auto-confirm flag.

Solution

Replace apt with apt-get or apt-cache to ensure consistent, non-interactive execution in Docker builds.

Problematic code

FROM ubuntu:20.04
USER nobody
RUN apt update && apt install -y build-essential

Verified code

FROM ubuntu:20.04
USER nobody
RUN apt-get update && apt-get install -y --no-install-recommends build-essential

Source of the description

apt manual page, apt-get manual page