<p>I have below docker image, where I need to update patch to curl package, in below Docker image, in Line number 3 I am already doing update, but it is shown up in Vulnerabilities report.</p>
<p>I have added, RUN yum -y update curl at the end of Dockerfile, then it is not showing up in Vulnerabilities report.</p>
<p>Any fix?, All Packages must install with latest version, I dont want to be mention explicitly</p>
<p>or any mistakes in Dockerfile?</p>
<pre><code>FROM    centos:7 AS base

FROM        base AS build


# Install all dependenticies
RUN yum -y update \
    &amp;&amp; yum install -y openssl-devel bzip2-devel libffi-devel \
                      zlib-devel wget gcc make
# Below compile python from source


FROM        base

ENV         LD_LIBRARY_PATH=/usr/local/lib64:/usr/local/lib
COPY --from=build /usr/local/ /usr/local/

# Copy Code
COPY . /app/
WORKDIR /app

#Install code dependecies.
RUN /usr/local/bin/python -m pip install --upgrade pip \
    &amp;&amp; pip install -r requirements.txt

# Why, I need this step, when I already update RUN in line 3?, If I won't perform I see in compliance report, any fix?
RUN yum -y update curl

# run Application
ENTRYPOINT [&quot;python&quot;]
CMD [&quot;test.py&quot;]
</code></pre>

Vidya 
<p>In order to understand what constitutes an image, you need to look at a Dockerfile in a different way:</p>
<ul>
<li>Every step (with the exception of <code>FROM</code>) creates a new image, with the results of the previous step as a base.</li>
<li><code>FROM</code> doesn't use the previous step, but an explicitly specified one.</li>
</ul>
<p>Now, looking at your Dockerfile, you seem to wonder why <code>RUN yum -y update curl</code> doesn't work as expected. For easier understanding, let's trace it backwards:</p>
<ul>
<li><code>RUN yum -y update curl</code></li>
<li><code>RUN /usr/local/bin/python -m pip install --upgrade pip \ &amp;&amp; pip install -r requirements.txt</code></li>
<li><code>WORKDIR /app</code></li>
<li><code>COPY . /app/</code></li>
<li><code>COPY --from=build /usr/local/ /usr/local/</code></li>
<li><code>ENV         LD_LIBRARY_PATH=/usr/local/lib64:/usr/local/lib</code></li>
<li><code>FROM        base</code> -- at this point, the previous step is changed to the last step of <code>base</code></li>
<li><code>FROM    centos:7 AS base</code> -- here, the previous step is changed to <code>centos:7</code></li>
</ul>
<p>As you see, nowhere in the earlier steps is <code>yum update -y curl</code>!</p>
<p>BTW: Typing this, I'm wondering what your precise question is, i.e. whether this works or doesn't or whether you wonder why it's necessary. Are you aware of the difference between <code>yum update</code> and <code>yum update curl</code> even?</p>
