1. "Don't update system packages" is bad advice. There are base Docker images with out-of-date packages that need security updates. CentOS for example doesn't update their base image for months on end.

2. Given you do want system package updates, you need to deal with Docker caching breaking your security updates. So you need to rebuild your image from scratch, without caching, either every time there is a security update or on a weekly basis. https://pythonspeed.com/articles/docker-cache-insecure-image...

3. Not mentioned: don't use build secrets via ARG.

Some approaches to secure build secrets:

1. BuildKit supports them: https://docs.docker.com/develop/develop-images/build_enhance...

2. Via the network, which is a hack, but it works: https://pythonspeed.com/articles/docker-build-secrets/

3. Via multi-stage builds, but this destroys caching.