Ensure all docker images run update from base image

Author: lars-petter-hauge

backend/Dockerfile

@@ -10,6 +10,8 @@ RUN uv sync --package acidwatch-api --extra pg --frozen --no-dev --no-editable
 
 FROM python:3.13-slim
 
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
+
 COPY --from=build /app/.venv /app/.venv
 COPY backend/alembic /app/backend/alembic
 COPY backend/alembic.ini backend/entrypoint /app/backend/

backend/Dockerfile.local

@@ -1,5 +1,7 @@
 FROM python:3.12-slim
 
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
+
 ENV UV_NO_CACHE=1
 ENV UV_DYNAMIC_VERSIONING_BYPASS=0.1.0
 ENV PYTHONDONTWRITEBYTECODE 1

frontend/Dockerfile

@@ -9,6 +9,9 @@ RUN npm install
 RUN npm run build
 
 FROM docker.io/nginxinc/nginx-unprivileged
+
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
+
 WORKDIR /app
 COPY --from=builder /app/dist ./www
 COPY nginx-conf/nginx.conf /etc/nginx/conf.d/default.conf

frontend/Dockerfile.local

@@ -1,5 +1,7 @@
 FROM docker.io/library/node:22-bookworm-slim
 
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
+
 WORKDIR /app
 
 COPY package*.json ./

workers/arcs-exp/Dockerfile

@@ -14,6 +14,8 @@ RUN uv sync --project workers/arcs-exp --frozen --no-dev --no-editable
 
 FROM python:3.13-slim
 
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
+
 COPY --from=build /app/.venv /app/.venv
 
 ENV PATH="/app/.venv/bin:$PATH"

workers/arcs/Dockerfile

@@ -20,6 +20,8 @@ RUN uv sync --project workers/arcs --frozen --no-dev --no-editable
 
 FROM python:3.13-slim
 
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
+
 COPY --from=build /app/.venv /app/.venv
 
 # the bin and model folders are not included when installing arcs, so even though we added

workers/example/Dockerfile

@@ -11,6 +11,8 @@ RUN uv sync --project workers/example --frozen --no-dev --no-editable
 
 FROM python:3.13-slim
 
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
+
 COPY --from=build /app/.venv /app/.venv
 
 ENV PATH="/app/.venv/bin:$PATH"

workers/gibbs-minimization/Dockerfile

@@ -12,6 +12,7 @@ RUN uv sync --project workers/gibbs-minimization --frozen --no-dev --no-editable
 FROM python:3.13-slim
 
 RUN apt-get update && \
+    apt-get upgrade -y && \
     apt-get install -y --no-install-recommends openjdk-21-jre-headless && \
     rm -rf /var/lib/apt/lists/*
 

workers/phpitz-reactive/Dockerfile

@@ -11,6 +11,8 @@ RUN uv sync --project workers/phpitz-reactive --frozen --no-dev --no-editable
 
 FROM python:3.13-slim
 
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
+
 COPY --from=build /app/.venv /app/.venv
 
 ENV PATH="/app/.venv/bin:$PATH"

workers/phpitz-solubility/Dockerfile

@@ -11,6 +11,8 @@ RUN uv sync --project workers/phpitz-solubility --frozen --no-dev --no-editable
 
 FROM python:3.13-slim
 
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
+
 COPY --from=build /app/.venv /app/.venv
 
 ENV PATH="/app/.venv/bin:$PATH"