Upgrade all packages at the end of build

images/Dockerfile

@@ -17,10 +17,10 @@ WORKDIR /actions-runner
 # Configure git-core/ppa based on guidance here: https://git-scm.com/download/linux
 # The second `apt-get update` isn't strictly necessary, but let's leave it here to force the
 # image build to break if the ppa is suddenly unavailable.
-RUN apt-get update -y \
+RUN apt-get update \
  && apt-get install -y --no-install-recommends curl unzip sudo lsb-release gpg-agent software-properties-common \
  && add-apt-repository ppa:git-core/ppa \
- && apt-get update -y
+ && apt-get update
 
 RUN export RUNNER_ARCH=${TARGETARCH} \
  && if [ "$RUNNER_ARCH" = "amd64" ]; then export RUNNER_ARCH=x64 ; fi \
@@ -45,9 +45,10 @@ COPY --from=build /etc/apt/trusted.gpg.d/*.gpg /etc/apt/trusted.gpg.d/
 COPY --from=docker-cli --chown=root:root --chmod=0555 /usr/local/bin/docker /usr/bin/docker
 COPY --from=docker-cli --chown=root:root --chmod=0555 /usr/local/libexec/docker/cli-plugins/docker-buildx /usr/local/libexec/docker/cli-plugins/docker-buildx
 
-# Install a sane set of base utilities
-RUN apt-get update -y \
+# Install a sane set of base utilities and upgrade all system packages
+RUN apt-get update \
  && apt-get install -y --no-install-recommends sudo lsb-release gpg-agent software-properties-common curl git jq unzip \
+ && apt-get upgrade -y \
  && apt-get clean all \
  && rm -rf /var/lib/apt/lists/* /var/cache/apt/*