Both Debian and Ubuntu provide snapshot mirrors where you can specify a date to get the package lists as they looked at that time.

Which is only useful for historical invesigation - the old snapshot has security holes attackers know how to exploit.

	▲	lloeki an hour ago \| parent [-]
		> the old snapshot has security holes attackers know how to exploit. So is running `docker build` and the `RUN apt update` line doing a cache hit, except the latter is silent. The problem solved by pinning to the snapshot is not to magically be secure, it's knowing what a given image is made of so you can trivially assert which ones are safe and which ones aren't. In both cases you have to rebuild an image anyway so updating the snapshot is just a step that makes it explicit in code instead of implicit.