Comment by fivea

> That command itself means that a docker container is no longer reproducible.

It's a tradeoff between making container images reproducible, and not shipping security vulnerabilities.

People tend to prefer the latter.

Furthermore, you can exec your way into a container and check exactly which package version you installed.