Run apt-get update and install in the same RUN step

If apt-get update runs in its own layer, Docker caches it, and later installs use a stale package list. Weeks later that can fail outright or quietly install old versions.

Docker's own guidance is to chain update and install in one RUN instruction, and to clean up in that same step:

• apt-get update && apt-get install -y together, so the list is always fresh.
• --no-install-recommends, so you only get the packages you asked for.
• rm -rf /var/lib/apt/lists/* at the end, so the package index does not stay in the layer.

RUN apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates curl \
    && rm -rf /var/lib/apt/lists/*