Greptile Summary

This PR adds apt-get upgrade -y to all 8 Dockerfiles that install system packages, patching CVEs present in pinned base-image digests at build time. The change is logically sound and consistent across the sandbox images; the only two notes are specific to the main Dockerfile.

• DEBIAN_FRONTEND not set for apt-get upgrade (Dockerfile line 135): The subsequent apt-get install in the same RUN block sets DEBIAN_FRONTEND=noninteractive as an inline prefix, but the new apt-get upgrade -y line does not. If an upgraded package triggers a debconf configuration prompt, the Docker build will hang. The sandbox Dockerfiles avoid this by declaring ENV DEBIAN_FRONTEND=noninteractive at image scope.
• --no-install-recommends absent on apt-get upgrade (all 8 files): Every apt-get install call in the repo uses --no-install-recommends to keep image layers minimal, but the newly added upgrade commands do not carry this flag. An upgrade can pull in newly recommended packages that were not present at original install time, silently increasing image size.

Confidence Score: 4/5

• Safe to merge with minor hardening; the missing DEBIAN_FRONTEND=noninteractive on apt-get upgrade in the main Dockerfile is a latent hang risk worth addressing before widespread use.
• The change is minimal, well-scoped, and consistent across all sandbox images. The sandbox Dockerfiles set DEBIAN_FRONTEND globally via ENV so they are fully covered. The only non-trivial gap is the main Dockerfile's inline upgrade command lacking DEBIAN_FRONTEND, which is a build-reliability concern rather than a security or correctness issue. The missing --no-install-recommends is a best-practice concern.
• Dockerfile — the apt-get upgrade -y line should carry DEBIAN_FRONTEND=noninteractive for consistency and build reliability.

This is a comment left during a code review.
Path: Dockerfile
Line: 135

Comment:
**`DEBIAN_FRONTEND` not set for `apt-get upgrade`**

`DEBIAN_FRONTEND=noninteractive` is applied to the subsequent `apt-get install` but not to `apt-get upgrade -y`. If any upgraded package triggers a `debconf` configuration dialog (e.g., a timezone or locale package), the build will hang because Docker's build context has no interactive terminal. The sandbox Dockerfiles avoid this by exporting `DEBIAN_FRONTEND` as an `ENV` variable that covers all commands in the layer.

```suggestion
    DEBIAN_FRONTEND=noninteractive apt-get upgrade -y && \
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: Dockerfile
Line: 135

Comment:
**`--no-install-recommends` missing from `apt-get upgrade`**

All eight Dockerfiles pass `--no-install-recommends` to `apt-get install` to keep image layers minimal, but the newly added `apt-get upgrade -y` lines do not carry the same flag. When upgrading packages apt may pull in new recommended packages that weren't previously present, silently growing the image size.

This affects all changed files:
- `Dockerfile` line 135
- `Dockerfile.sandbox` line 10
- `Dockerfile.sandbox-browser` line 10
- `Dockerfile.sandbox-common` line 27
- `scripts/docker/cleanup-smoke/Dockerfile` line 8
- `scripts/docker/install-sh-e2e/Dockerfile` line 8
- `scripts/docker/install-sh-nonroot/Dockerfile` line 14
- `scripts/docker/install-sh-smoke/Dockerfile` line 14

For consistency with the rest of each `RUN` layer, consider adding `--no-install-recommends`:

```suggestion
    apt-get upgrade -y --no-install-recommends && \
```

How can I resolve this? If you propose a fix, please make it concise.

_{Last reviewed commit: 71a12da}