The RUN instruction

RUN runs a command during the build and adds the result to the image as a new layer. It is used for installing packages, compiling and creating directories:

FROM ubuntu:24.04
RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*

update and install must be in the same RUN; written separately, the install may use a stale cached package list. The trailing rm shrinks the layer by deleting the package lists.

Each RUN is a separate layer. A file downloaded in one layer and deleted in the next doesn't shrink the image, since the earlier layer doesn't change. That is why installing and cleaning up are done in the same RUN:

# bad: 3 layers, cache files stay in the image
RUN apt-get update
RUN apt-get install -y curl
RUN rm -rf /var/lib/apt/lists/*

# good: a single layer
RUN apt-get update \
    && apt-get install -y --no-install-recommends curl \
    && rm -rf /var/lib/apt/lists/*