If I remember correctly it's like this: RUN cache is invalidated when the text (the whole RUN line) itself changes, which can be bad if you update a remote zip

If I remember correctly it's like this: RUN cache is invalidated when the text (the whole RUN line) itself changes, which can be bad if you update a remote zip archive that you download with `RUN curl ...` and then expect the image to be updated after a simple `docker build`. This also goes for `RUN apk add ...` where the package might have received critical security updates but you're not getting them into your image because the cache is used. COPY and ADD caches are invalidated when the hash of the actual file content that's added changes, which is usually what you want.