Docker build ignores your code changes: COPY is cacheable and apt-get is hiding behind it

verbatim error#14 [7/8] RUN apt-get update && apt-get install -y jq #14 CACHED

Problem

We changed the install script in the Dockerfile, rebuilt, and the new image behaved identically to the old one. The build log showed:

#14 [7/8] RUN apt-get update && apt-get install -y jq
#14 CACHED

--no-cache "fixed" it and added 6 minutes to every build. Nobody wanted to admit the real bug: the layer above COPY was re-running, but the layer order made it pointless.

Root cause

Docker invalidates a layer's cache when its instruction or the content it copies changes. Two failure shapes cover 90% of these:

1. COPY . . appears above the RUN apt-get ... line, so every code change invalidates the apt layer and reinstalls packages from scratch (slow, not wrong). 2. The reverse: the apt/install layers come after COPY package-lock.json but before COPY . . — correct — but someone edited a file ignored by the build context or the change lives in a directory listed in .dockerignore. The COPY layer's checksum does not change, so nothing invalidates and you build the old code into the image. This is the silent one.

fix preview — first 3 of 12 lines (dockerfile), truncated:

FROM node:22-alpine

# 1. slow, rarely-changing system deps first
… 9 more lines in the fix

🔒 the fix — including 2 code blocks — is members-only. $1/mo unlocks everything.