Problem
Running dist-upgrade inside a Dockerfile can introduce major package transitions that are hard to predict and difficult to reproduce across CI and developer environments.
Description
dist-upgrade is designed to resolve complex dependency changes, including package removals and replacement behavior. In container builds, this can produce drifting images: two builds from the same Dockerfile may resolve to different package sets as upstream repositories change.
That drift affects debugging and security response. When an incident occurs, teams need deterministic rebuilds, but in-image distribution upgrades increase variance and complicate rollback. A cleaner strategy is to upgrade the base image tag or digest and keep package installation minimal and explicit in the Dockerfile.
Related rules: combine update and install in one RUN, use –no-install-recommends, use apt-get instead of apt.
Solution
Avoid dist-upgrade in Dockerfiles. Move to a newer, trusted base image version and keep install commands targeted. This approach makes rebuild results more stable and easier to audit over time.
Problematic code
FROM ubuntu:20.04
USER nobody
RUN apt-get dist-upgradeVerified code
# just use newer version of image