Do not use apt-get dist-upgrade.

Problematic code:

FROM debian
RUN apt-get update && apt-get dist-upgrade 

Correct code:

FROM debian
RUN apt-get update && apt-get upgrade

Rationale:

(rationale is outdated)

http://crosbymichael.com/dockerfile-best-practices-take-2.html

Updates will be baked into the base images, so you don't need to run apt-get upgrade in your containers. Because of the isolation that happens this can often fail if something is trying to modify init or make device changes inside a container. It also produces inconsistent images because you no longer have one source of truth of how your application should run and what versions of dependencies are included in the image.