Hi Tomasz,

Thanks for answering! I'll inline my slightly belated comments inline.

Tomasz Torcz <tomek@???> writes:

> On Wed, Jul 10, 2024 at 10:09:49AM +0200, Didier Kryn wrote:
>> Le 08/07/2024 à 16:06, Steve Litt a écrit :
>> > Olaf Meeuwissen via Dng said on Mon, 08 Jul 2024 20:26:58 +0900
>> >
>> >
>> > > Rather that running apt-get upgrade (which is generally advised against
>> > > IIRC),
>> > I'm not knowledgeable with the apt system. What's wrong with apt-get
>> > upgrade?
>>
>>     I often run apt-get upgrade. I too would like to know why it isn't

I said that in the context of building Docker container images. In the
context of virtual and bare metal machines, running

apt-get update
apt list --upgradable

is a Good Thing. Whether you then run

apt-get upgrade

or selectively upgrade only packages that come from your *-security
suite is up to you.

Back to the context of building Docker container images. This relies
heavily on caching. Meaning that Lorenzo's

FROM debian:sid

will *not* pull a new debian:sid image if you already have a debian:sid
image in *your* local cache. If you do, that image is likely to be very
different from the debian:sid I pull or have in *my* cache.

The same holds for the

RUN apt-get update && apt-get upgrade -y

statement. It only gets run the first time you build the image after
pulling the debian:sid image. After that, whatever ended up in the
cache will get reused as is. Meaning that you will *not* be upgrading
anything!

Combined, that leads to Tomasz' observations that

> It makes container images non-reproductible. Each build could end up
> with different package versions. It breaks collaboration with others.

> On the other hand, if you are building containers on the same machine,
> apt-get invocation will be cached and not repeated. So if you build
> container again after few months and expect to have fresh upgrades
> applied, it won't work.

Exactly, you will be happily running with the upgrades you did a few
months ago and never be the wiser.

BTW, I'll be getting back to Tom's reply separately.

Hope this helps,
--
Olaf Meeuwissen