On 7/8/2026 1:19 AM, Daniel P. Berrangé wrote: > On Tue, Jul 07, 2026 at 02:46:53PM -0700, Pierrick Bouvier wrote: >> RUN statements should always use apt update && apt install together: >> https://docs.docker.com/build/building/best-practices/#apt-get >> >> Signed-off-by: Pierrick Bouvier <[email protected]> >> --- >> tests/docker/dockerfiles/ubuntu2404.docker | 3 ++- >> tests/lcitool/refresh | 3 ++- >> 2 files changed, 4 insertions(+), 2 deletions(-) >> >> diff --git a/tests/docker/dockerfiles/ubuntu2404.docker >> b/tests/docker/dockerfiles/ubuntu2404.docker >> index 26bc2dd94f4..27992e34fd9 100644 >> --- a/tests/docker/dockerfiles/ubuntu2404.docker >> +++ b/tests/docker/dockerfiles/ubuntu2404.docker >> @@ -160,7 +160,8 @@ ENV RUSTC=/usr/bin/rustc-1.83 >> ENV RUSTDOC=/usr/bin/rustdoc-1.83 >> ENV CARGO_HOME=/usr/local/cargo >> ENV PATH=$CARGO_HOME/bin:$PATH >> -RUN DEBIAN_FRONTEND=noninteractive eatmydata \ >> +RUN apt update && \ >> + DEBIAN_FRONTEND=noninteractive eatmydata \ >> apt install -y --no-install-recommends cargo >> RUN cargo install --locked bindgen-cli >> # As a final step configure the user (if env is defined) >> diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh >> index 1fdd37440c9..bbbc6d3c46a 100755 >> --- a/tests/lcitool/refresh >> +++ b/tests/lcitool/refresh >> @@ -157,7 +157,8 @@ ENV RUSTC=/usr/bin/rustc-1.83 >> ENV RUSTDOC=/usr/bin/rustdoc-1.83 >> ENV CARGO_HOME=/usr/local/cargo >> ENV PATH=$CARGO_HOME/bin:$PATH >> -RUN DEBIAN_FRONTEND=noninteractive eatmydata \ >> +RUN apt update && \ >> + DEBIAN_FRONTEND=noninteractive eatmydata \ >> apt install -y --no-install-recommends cargo >> RUN cargo install --locked bindgen-cli > > So lcitool already ran 'apt update' earlier, but if we're trying to > avoid caching issues, I guess running it again is needed. Should we > also run 'apt dist-upgrade' though, as already installed content in > the cached layer can be outdated. >
upgrade/dist-upgrade are not needed, we just address the packages listing issue, not the fact they are up to date or not. In fact, if you want an updated container, the good practice is to rebuild them from scratch. For our use case, it's definitely not needed as we don't have security concerns to address for local containers. > With regards, > Daniel
