{"action":"created","issue":{"url":"https://api.github.com/repos/yegor256/rultor/issues/1010","repository_url":"https://api.github.com/repos/yegor256/rultor","labels_url":"https://api.github.com/repos/yegor256/rultor/issues/1010/labels{/name}","comments_url":"https://api.github.com/repos/yegor256/rultor/issues/1010/comments","events_url":"https://api.github.com/repos/yegor256/rultor/issues/1010/events","html_url":"https://github.com/yegor256/rultor/issues/1010","id":134403075,"number":1010,"title":"APT usage in Dockerfile violates best practices ( apt-get upgrade used, not pairing apt-get update and install )","user":{"login":"original-brownbear","id":6490959,"avatar_url":"https://avatars.githubusercontent.com/u/6490959?v=3","gravatar_id":"","url":"https://api.github.com/users/original-brownbear","html_url":"https://github.com/original-brownbear","followers_url":"https://api.github.com/users/original-brownbear/followers","following_url":"https://api.github.com/users/original-brownbear/following{/other_user}","gists_url":"https://api.github.com/users/original-brownbear/gists{/gist_id}","starred_url":"https://api.github.com/users/original-brownbear/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/original-brownbear/subscriptions","organizations_url":"https://api.github.com/users/original-brownbear/orgs","repos_url":"https://api.github.com/users/original-brownbear/repos","events_url":"https://api.github.com/users/original-brownbear/events{/privacy}","received_events_url":"https://api.github.com/users/original-brownbear/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/yegor256/rultor/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-02-17T21:20:20Z","updated_at":"2016-02-21T17:52:01Z","closed_at":null,"body":"The current Dockerfile violates best practices for apt use, documented [here](https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices/#apt-get), in two ways that need to be fixed together.\r\n# apt-get upgrade use\r\n\r\nAt the end of the Dockerfile it contains the snippet\r\n```\r\n# One more time, right before the end\r\nRUN apt-get update -y\r\nRUN apt-get upgrade -qq -y\r\n```\r\n\r\nThe Docker documentation states:\r\n\r\n> You should avoid RUN apt-get upgrade or dist-upgrade, as many of the “essential” packages from the base images won’t upgrade inside an unprivileged container. \r\n\r\nGiven the removal of the --privileged flag in the Rultor Docker run in https://github.com/yegor256/rultor/pull/1008, `apt-get upgrade` should be removed from the Dockerfile.\r\n\r\nThe functionality it provides needs to be substituted by by correctly grouping  `apt-get update` and `apt-get install` in the same run command and pinning the versions as suggested by [Docker docs](https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices/#apt-get):\r\n\r\n> Using apt-get update alone in a RUN statement causes caching issues and subsequent apt-get install instructions fail. \r\n\r\nExample:\r\nLines like these:\r\n```\r\nRUN apt-get update\r\nRUN apt-get install -y wget bcrypt curl\r\nRUN apt-get install -y unzip zip\r\n```\r\nShould in order to keep the build stable and make it deterministic become:\r\n```\r\nRUN apt-get update && apt-get install -y \\\r\n wget=1.15-1ubuntu1.14.04.1 \\\r\n bcrypt=1.1-8 \\\r\n curl=7.35.0-1ubuntu2.6 \\\r\n unzip=6.0-9ubuntu1.5 \\\r\n zip=3.0-8\r\n```\r\n* Versions taken from the last successful Docker build [here](https://hub.docker.com/r/yegor256/rultor/builds/brirl5gzhczeuhgh2cfepbd/).\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/yegor256/rultor/issues/comments/186872936","html_url":"https://github.com/yegor256/rultor/issues/1010#issuecomment-186872936","issue_url":"https://api.github.com/repos/yegor256/rultor/issues/1010","id":186872936,"user":{"login":"alex-palevsky","id":4267913,"avatar_url":"https://avatars.githubusercontent.com/u/4267913?v=3","gravatar_id":"","url":"https://api.github.com/users/alex-palevsky","html_url":"https://github.com/alex-palevsky","followers_url":"https://api.github.com/users/alex-palevsky/followers","following_url":"https://api.github.com/users/alex-palevsky/following{/other_user}","gists_url":"https://api.github.com/users/alex-palevsky/gists{/gist_id}","starred_url":"https://api.github.com/users/alex-palevsky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alex-palevsky/subscriptions","organizations_url":"https://api.github.com/users/alex-palevsky/orgs","repos_url":"https://api.github.com/users/alex-palevsky/repos","events_url":"https://api.github.com/users/alex-palevsky/events{/privacy}","received_events_url":"https://api.github.com/users/alex-palevsky/received_events","type":"User","site_admin":false},"created_at":"2016-02-21T17:52:01Z","updated_at":"2016-02-21T17:52:01Z","body":"@original-brownbear tag \"bug\" added"}}