Understood, just trying to point out there is still a flaw with the image (in that updates are actually important!) FWIW at my work, we don't use apt for insta

Understood, just trying to point out there is still a flaw with the image (in that updates are actually important!) FWIW at my work, we don't use apt for installing packages. We compile the packages as a part of the Docker build. This generates mostly idempotent builds.