Update packages during build

[TommyTran732]

Upstream doesn't always ship the latest packages on Debian, so it is good practice to run an apt-get full-upgrade. This is important to patch vulnerabilities for stuff like OpenSSL for example.

[TheArcaneBrony]

I don't believe this PR is a good fit for the project. General system maintenance is the responsibility of the end user, not the individual applications you install, nor does it make any difference in the final result.
Draupnir does not use OpenSSL anyhow (outside of nodejs itself, which is an implementation detail and not a direct dependency of Draupnir).

[TheArcaneBrony]

I checked a little bit closer, and it seems you're updating the dockerfile - here it's even more problematic because updating the system's packages rather than updating the base image itself is a dramatic increase in closure size.

[TommyTran732]

Draupnir does not use OpenSSL anyhow (outside of nodejs itself, which is an implementation detail and not a direct dependency of Draupnir).

Doesn't matter, do you wanna make calls to your Matrix server with an admin token with vulnerable OpenSSL?

I checked a little bit closer, and it seems you're updating the dockerfile - here it's even more problematic because updating the system's packages rather than updating the base image itself is a dramatic increase in closure size.

As discussed on Matrix, the Node image is based on the Buildpack image, which in turn is based on the Debian image, all of which only gets updated about once a month. On top of that, Draupnir itself only gets a new release around once a month Depending on how things line up, the Draupnir image will either go out of date anywhere from 1 day out of date to 2 months out of date.

dramatic increase in closure size

No it doesn't. The only thing that would do this is /var/apt/cache which can be dealt with by a simple && rm -rf /var/cache/apt

[Gnuxie]

@TommyTran732 could you sign off please? https://the-draupnir-project.github.io/draupnir-documentation/contributing#sign-off