diff --git a/Dockerfile b/Dockerfile
index 7bbb378a96f0..f12326c646a5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -33,7 +33,7 @@ RUN dpkg --add-architecture s390x && \
   dpkg --add-architecture armhf && \
   dpkg --add-architecture arm64 && \
   apt-get update && \
-  apt-get install -y \
+  apt-get --no-install-recommends install -y \
   gcc-s390x-linux-gnu libc6-dev-s390x-cross libseccomp-dev:s390x \
   crossbuild-essential-ppc64el libseccomp-dev:ppc64el \
   crossbuild-essential-armel libseccomp-dev:armel \
@@ -135,7 +135,7 @@ WORKDIR /usr/src
 RUN git clone https://github.com/containerd/containerd.git containerd
 
 FROM gobuild-base AS containerd-base
-RUN apt-get install -y --no-install-recommends btrfs-progs libbtrfs-dev
+RUN apt-get --no-install-recommends install -y btrfs-progs libbtrfs-dev
 WORKDIR /go/src/github.com/containerd/containerd
 
 FROM containerd-base AS containerd
@@ -229,7 +229,7 @@ RUN curl -Ls https://github.com/containernetworking/plugins/releases/download/$C
 
 FROM buildkit-base AS integration-tests-base
 ENV BUILDKIT_INTEGRATION_ROOTLESS_IDPAIR="1000:1000"
-RUN apt-get install -y --no-install-recommends uidmap sudo vim iptables \ 
+RUN apt-get --no-install-recommends install -y uidmap sudo vim iptables \ 
   && useradd --create-home --home-dir /home/user --uid 1000 -s /bin/sh user \
   && echo "XDG_RUNTIME_DIR=/run/user/1000; export XDG_RUNTIME_DIR" >> /home/user/.profile \
   && mkdir -m 0700 -p /run/user/1000 \
diff --git a/frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile b/frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile
index 41a07ea5d292..dc7462c6e663 100644
--- a/frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile
+++ b/frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile
@@ -16,7 +16,7 @@ RUN --mount=target=. \
   echo -n "${VERSION}" | tee /tmp/.version;
 
 FROM base AS build
-RUN apt-get update && apt-get install -y --no-install-recommends file
+RUN apt-get update && apt-get --no-install-recommends install -y file
 ARG BUILDTAGS=""
 ARG TARGETPLATFORM
 ENV TARGETPLATFORM=$TARGETPLATFORM
@@ -33,7 +33,7 @@ ENTRYPOINT ["/bin/dockerfile-frontend"]
 
 
 FROM base AS buildid-check
-RUN apt-get update && apt-get install -y jq
+RUN apt-get update && apt-get --no-install-recommends install -y jq
 COPY /frontend/dockerfile/cmd/dockerfile-frontend/hack/check-daily-outdated .
 COPY --from=r.j3ss.co/reg /usr/bin/reg /bin
 COPY --from=build /dockerfile-frontend .
diff --git a/frontend/dockerfile/docs/experimental.md b/frontend/dockerfile/docs/experimental.md
index 876dc1061d74..c74641cb0120 100644
--- a/frontend/dockerfile/docs/experimental.md
+++ b/frontend/dockerfile/docs/experimental.md
@@ -61,7 +61,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build go build ...
 FROM ubuntu
 RUN rm -f /etc/apt/apt.conf.d/docker-clean; echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache
 RUN --mount=type=cache,target=/var/cache/apt --mount=type=cache,target=/var/lib/apt \
-  apt update && apt install -y gcc
+  apt update && apt-get --no-install-recommends install -y gcc
 ```
 
 ### `RUN --mount=type=tmpfs`
diff --git a/frontend/dockerfile/parser/testfile-line/Dockerfile b/frontend/dockerfile/parser/testfile-line/Dockerfile
index c7601c9f692b..39184011a400 100644
--- a/frontend/dockerfile/parser/testfile-line/Dockerfile
+++ b/frontend/dockerfile/parser/testfile-line/Dockerfile
@@ -18,7 +18,7 @@ RUN apt-get update \
 	&& dpkg -l | awk '/^ii/ {print $2}' > /tmp/dpkg.clean \
 
 
-    && apt-get install -y --no-install-recommends git golang ca-certificates \
+    && apt-get --no-install-recommends install -y git golang ca-certificates \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists \
 
diff --git a/frontend/dockerfile/parser/testfiles/brimstone-consuldock/Dockerfile b/frontend/dockerfile/parser/testfiles/brimstone-consuldock/Dockerfile
index 9c0952acb0bd..67c67f723c7e 100644
--- a/frontend/dockerfile/parser/testfiles/brimstone-consuldock/Dockerfile
+++ b/frontend/dockerfile/parser/testfiles/brimstone-consuldock/Dockerfile
@@ -13,7 +13,7 @@ ENTRYPOINT ["/usr/local/bin/consuldock"]
 # Install the packages we need, clean up after them and us
 RUN apt-get update \
 	&& dpkg -l | awk '/^ii/ {print $2}' > /tmp/dpkg.clean \
-    && apt-get install -y --no-install-recommends git golang ca-certificates \
+    && apt-get --no-install-recommends install -y git golang ca-certificates \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists \
 
diff --git a/frontend/dockerfile/parser/testfiles/brimstone-consuldock/result b/frontend/dockerfile/parser/testfiles/brimstone-consuldock/result
index 3b45db62b466..e3389d27907f 100644
--- a/frontend/dockerfile/parser/testfiles/brimstone-consuldock/result
+++ b/frontend/dockerfile/parser/testfiles/brimstone-consuldock/result
@@ -2,4 +2,4 @@
 (label "maintainer" "brimstone@the.narro.ws")
 (env "GOPATH" "/go")
 (entrypoint "/usr/local/bin/consuldock")
-(run "apt-get update \t&& dpkg -l | awk '/^ii/ {print $2}' > /tmp/dpkg.clean     && apt-get install -y --no-install-recommends git golang ca-certificates     && apt-get clean     && rm -rf /var/lib/apt/lists \t&& go get -v github.com/brimstone/consuldock     && mv $GOPATH/bin/consuldock /usr/local/bin/consuldock \t&& dpkg -l | awk '/^ii/ {print $2}' > /tmp/dpkg.dirty \t&& apt-get remove --purge -y $(diff /tmp/dpkg.clean /tmp/dpkg.dirty | awk '/^>/ {print $2}') \t&& rm /tmp/dpkg.* \t&& rm -rf $GOPATH")
+(run "apt-get update \t&& dpkg -l | awk '/^ii/ {print $2}' > /tmp/dpkg.clean     && apt-get --no-install-recommends install -y git golang ca-certificates     && apt-get clean     && rm -rf /var/lib/apt/lists \t&& go get -v github.com/brimstone/consuldock     && mv $GOPATH/bin/consuldock /usr/local/bin/consuldock \t&& dpkg -l | awk '/^ii/ {print $2}' > /tmp/dpkg.dirty \t&& apt-get remove --purge -y $(diff /tmp/dpkg.clean /tmp/dpkg.dirty | awk '/^>/ {print $2}') \t&& rm /tmp/dpkg.* \t&& rm -rf $GOPATH")
diff --git a/frontend/dockerfile/parser/testfiles/brimstone-docker-consul/Dockerfile b/frontend/dockerfile/parser/testfiles/brimstone-docker-consul/Dockerfile
index 25ae352166c9..95c3dec9a416 100644
--- a/frontend/dockerfile/parser/testfiles/brimstone-docker-consul/Dockerfile
+++ b/frontend/dockerfile/parser/testfiles/brimstone-docker-consul/Dockerfile
@@ -7,7 +7,7 @@ ENTRYPOINT ["/usr/bin/consul", "agent", "-server", "-data-dir=/consul", "-client
 EXPOSE 8500 8600 8400 8301 8302
 
 RUN apt-get update \
-    && apt-get install -y unzip wget \
+    && apt-get --no-install-recommends install -y unzip wget \
 	&& apt-get clean \
 	&& rm -rf /var/lib/apt/lists
 
@@ -20,7 +20,7 @@ RUN cd /tmp \
 
 RUN apt-get update \
 	&& dpkg -l | awk '/^ii/ {print $2}' > /tmp/dpkg.clean \
-    && apt-get install -y --no-install-recommends unzip wget \
+    && apt-get --no-install-recommends install -y unzip wget \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists \
 
@@ -39,7 +39,7 @@ ENV GOPATH /go
 
 RUN apt-get update \
 	&& dpkg -l | awk '/^ii/ {print $2}' > /tmp/dpkg.clean \
-    && apt-get install -y --no-install-recommends git golang ca-certificates build-essential \
+    && apt-get --no-install-recommends install -y git golang ca-certificates build-essential \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists \
 
diff --git a/frontend/dockerfile/parser/testfiles/brimstone-docker-consul/result b/frontend/dockerfile/parser/testfiles/brimstone-docker-consul/result
index 16492e516ade..38d2429825d6 100644
--- a/frontend/dockerfile/parser/testfiles/brimstone-docker-consul/result
+++ b/frontend/dockerfile/parser/testfiles/brimstone-docker-consul/result
@@ -2,8 +2,8 @@
 (cmd)
 (entrypoint "/usr/bin/consul" "agent" "-server" "-data-dir=/consul" "-client=0.0.0.0" "-ui-dir=/webui")
 (expose "8500" "8600" "8400" "8301" "8302")
-(run "apt-get update     && apt-get install -y unzip wget \t&& apt-get clean \t&& rm -rf /var/lib/apt/lists")
+(run "apt-get update     && apt-get --no-install-recommends install -y unzip wget \t&& apt-get clean \t&& rm -rf /var/lib/apt/lists")
 (run "cd /tmp     && wget https://dl.bintray.com/mitchellh/consul/0.3.1_web_ui.zip        -O web_ui.zip     && unzip web_ui.zip     && mv dist /webui     && rm web_ui.zip")
-(run "apt-get update \t&& dpkg -l | awk '/^ii/ {print $2}' > /tmp/dpkg.clean     && apt-get install -y --no-install-recommends unzip wget     && apt-get clean     && rm -rf /var/lib/apt/lists     && cd /tmp     && wget https://dl.bintray.com/mitchellh/consul/0.3.1_web_ui.zip        -O web_ui.zip     && unzip web_ui.zip     && mv dist /webui     && rm web_ui.zip \t&& dpkg -l | awk '/^ii/ {print $2}' > /tmp/dpkg.dirty \t&& apt-get remove --purge -y $(diff /tmp/dpkg.clean /tmp/dpkg.dirty | awk '/^>/ {print $2}') \t&& rm /tmp/dpkg.*")
+(run "apt-get update \t&& dpkg -l | awk '/^ii/ {print $2}' > /tmp/dpkg.clean     && apt-get --no-install-recommends install -y unzip wget     && apt-get clean     && rm -rf /var/lib/apt/lists     && cd /tmp     && wget https://dl.bintray.com/mitchellh/consul/0.3.1_web_ui.zip        -O web_ui.zip     && unzip web_ui.zip     && mv dist /webui     && rm web_ui.zip \t&& dpkg -l | awk '/^ii/ {print $2}' > /tmp/dpkg.dirty \t&& apt-get remove --purge -y $(diff /tmp/dpkg.clean /tmp/dpkg.dirty | awk '/^>/ {print $2}') \t&& rm /tmp/dpkg.*")
 (env "GOPATH" "/go")
-(run "apt-get update \t&& dpkg -l | awk '/^ii/ {print $2}' > /tmp/dpkg.clean     && apt-get install -y --no-install-recommends git golang ca-certificates build-essential     && apt-get clean     && rm -rf /var/lib/apt/lists \t&& go get -v github.com/hashicorp/consul \t&& mv $GOPATH/bin/consul /usr/bin/consul \t&& dpkg -l | awk '/^ii/ {print $2}' > /tmp/dpkg.dirty \t&& apt-get remove --purge -y $(diff /tmp/dpkg.clean /tmp/dpkg.dirty | awk '/^>/ {print $2}') \t&& rm /tmp/dpkg.* \t&& rm -rf $GOPATH")
+(run "apt-get update \t&& dpkg -l | awk '/^ii/ {print $2}' > /tmp/dpkg.clean     && apt-get --no-install-recommends install -y git golang ca-certificates build-essential     && apt-get clean     && rm -rf /var/lib/apt/lists \t&& go get -v github.com/hashicorp/consul \t&& mv $GOPATH/bin/consul /usr/bin/consul \t&& dpkg -l | awk '/^ii/ {print $2}' > /tmp/dpkg.dirty \t&& apt-get remove --purge -y $(diff /tmp/dpkg.clean /tmp/dpkg.dirty | awk '/^>/ {print $2}') \t&& rm /tmp/dpkg.* \t&& rm -rf $GOPATH")
diff --git a/frontend/dockerfile/parser/testfiles/cpuguy83-nagios/Dockerfile b/frontend/dockerfile/parser/testfiles/cpuguy83-nagios/Dockerfile
index 8ccb71a57894..b10e67a7e57b 100644
--- a/frontend/dockerfile/parser/testfiles/cpuguy83-nagios/Dockerfile
+++ b/frontend/dockerfile/parser/testfiles/cpuguy83-nagios/Dockerfile
@@ -11,7 +11,7 @@ ENV APACHE_RUN_GROUP nagios
 ENV NAGIOS_TIMEZONE UTC
 
 RUN sed -i 's/universe/universe multiverse/' /etc/apt/sources.list
-RUN apt-get update && apt-get install -y iputils-ping netcat build-essential snmp snmpd snmp-mibs-downloader php5-cli apache2 libapache2-mod-php5 runit bc postfix bsd-mailx
+RUN apt-get update && apt-get --no-install-recommends install -y iputils-ping netcat build-essential snmp snmpd snmp-mibs-downloader php5-cli apache2 libapache2-mod-php5 runit bc postfix bsd-mailx
 RUN ( egrep -i  "^${NAGIOS_GROUP}" /etc/group || groupadd $NAGIOS_GROUP ) && ( egrep -i "^${NAGIOS_CMDGROUP}" /etc/group || groupadd $NAGIOS_CMDGROUP )
 RUN ( id -u $NAGIOS_USER || useradd --system $NAGIOS_USER -g $NAGIOS_GROUP -d $NAGIOS_HOME ) && ( id -u $NAGIOS_CMDUSER || useradd --system -d $NAGIOS_HOME -g $NAGIOS_CMDGROUP $NAGIOS_CMDUSER )
 
diff --git a/frontend/dockerfile/parser/testfiles/cpuguy83-nagios/result b/frontend/dockerfile/parser/testfiles/cpuguy83-nagios/result
index 25dd3ddfe58a..2e811731d216 100644
--- a/frontend/dockerfile/parser/testfiles/cpuguy83-nagios/result
+++ b/frontend/dockerfile/parser/testfiles/cpuguy83-nagios/result
@@ -10,7 +10,7 @@
 (env "APACHE_RUN_GROUP" "nagios")
 (env "NAGIOS_TIMEZONE" "UTC")
 (run "sed -i 's/universe/universe multiverse/' /etc/apt/sources.list")
-(run "apt-get update && apt-get install -y iputils-ping netcat build-essential snmp snmpd snmp-mibs-downloader php5-cli apache2 libapache2-mod-php5 runit bc postfix bsd-mailx")
+(run "apt-get update && apt-get --no-install-recommends install -y iputils-ping netcat build-essential snmp snmpd snmp-mibs-downloader php5-cli apache2 libapache2-mod-php5 runit bc postfix bsd-mailx")
 (run "( egrep -i  \"^${NAGIOS_GROUP}\" /etc/group || groupadd $NAGIOS_GROUP ) && ( egrep -i \"^${NAGIOS_CMDGROUP}\" /etc/group || groupadd $NAGIOS_CMDGROUP )")
 (run "( id -u $NAGIOS_USER || useradd --system $NAGIOS_USER -g $NAGIOS_GROUP -d $NAGIOS_HOME ) && ( id -u $NAGIOS_CMDUSER || useradd --system -d $NAGIOS_HOME -g $NAGIOS_CMDGROUP $NAGIOS_CMDUSER )")
 (add "http://downloads.sourceforge.net/project/nagios/nagios-3.x/nagios-3.5.1/nagios-3.5.1.tar.gz?r=http%3A%2F%2Fwww.nagios.org%2Fdownload%2Fcore%2Fthanks%2F%3Ft%3D1398863696&ts=1398863718&use_mirror=superb-dca3" "/tmp/nagios.tar.gz")
diff --git a/frontend/dockerfile/parser/testfiles/docker/Dockerfile b/frontend/dockerfile/parser/testfiles/docker/Dockerfile
index cd327aa499e0..9010bbc83d51 100644
--- a/frontend/dockerfile/parser/testfiles/docker/Dockerfile
+++ b/frontend/dockerfile/parser/testfiles/docker/Dockerfile
@@ -19,7 +19,7 @@ FROM	ubuntu:14.04
 LABEL	maintainer	Tianon Gravi <admwiggin@gmail.com> (@tianon)
 
 # Packaged dependencies
-RUN	apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -yq \
+RUN	apt-get update && DEBIAN_FRONTEND=noninteractive apt-get --no-install-recommends install -yq \
 	apt-utils \
 	aufs-tools \
 	automake \
diff --git a/frontend/dockerfile/parser/testfiles/docker/result b/frontend/dockerfile/parser/testfiles/docker/result
index 0c2f22991621..0c7f81b00d99 100644
--- a/frontend/dockerfile/parser/testfiles/docker/result
+++ b/frontend/dockerfile/parser/testfiles/docker/result
@@ -1,6 +1,6 @@
 (from "ubuntu:14.04")
 (label "maintainer" "Tianon Gravi <admwiggin@gmail.com> (@tianon)")
-(run "apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -yq \tapt-utils \taufs-tools \tautomake \tbtrfs-tools \tbuild-essential \tcurl \tdpkg-sig \tgit \tiptables \tlibapparmor-dev \tlibcap-dev \tmercurial \tpandoc \tparallel \treprepro \truby1.9.1 \truby1.9.1-dev \ts3cmd=1.1.0* \t--no-install-recommends")
+(run "apt-get update && DEBIAN_FRONTEND=noninteractive apt-get --no-install-recommends install -yq \tapt-utils \taufs-tools \tautomake \tbtrfs-tools \tbuild-essential \tcurl \tdpkg-sig \tgit \tiptables \tlibapparmor-dev \tlibcap-dev \tmercurial \tpandoc \tparallel \treprepro \truby1.9.1 \truby1.9.1-dev \ts3cmd=1.1.0* \t--no-install-recommends")
 (run "git clone --no-checkout https://git.fedorahosted.org/git/lvm2.git /usr/local/lvm2 && cd /usr/local/lvm2 && git checkout -q v2_02_103")
 (run "cd /usr/local/lvm2 && ./configure --enable-static_link && make device-mapper && make install_device-mapper")
 (run "curl -sSL https://golang.org/dl/go1.3.src.tar.gz | tar -v -C /usr/local -xz")
diff --git a/frontend/dockerfile/parser/testfiles/kartar-entrypoint-oddities/Dockerfile b/frontend/dockerfile/parser/testfiles/kartar-entrypoint-oddities/Dockerfile
index 728ec9a78782..78317ace9a80 100644
--- a/frontend/dockerfile/parser/testfiles/kartar-entrypoint-oddities/Dockerfile
+++ b/frontend/dockerfile/parser/testfiles/kartar-entrypoint-oddities/Dockerfile
@@ -2,6 +2,6 @@ FROM ubuntu:14.04
 LABEL maintainer James Turnbull "james@example.com"
 ENV REFRESHED_AT 2014-06-01
 RUN apt-get update
-RUN apt-get -y install redis-server redis-tools
+RUN apt-get --no-install-recommends install -y redis-server redis-tools
 EXPOSE 6379
 ENTRYPOINT [ "/usr/bin/redis-server" ]
diff --git a/frontend/dockerfile/parser/testfiles/kartar-entrypoint-oddities/result b/frontend/dockerfile/parser/testfiles/kartar-entrypoint-oddities/result
index e774bc4f972c..613e242c1f80 100644
--- a/frontend/dockerfile/parser/testfiles/kartar-entrypoint-oddities/result
+++ b/frontend/dockerfile/parser/testfiles/kartar-entrypoint-oddities/result
@@ -2,6 +2,6 @@
 (label "maintainer" "James Turnbull \"james@example.com\"")
 (env "REFRESHED_AT" "2014-06-01")
 (run "apt-get update")
-(run "apt-get -y install redis-server redis-tools")
+(run "apt-get --no-install-recommends install -y redis-server redis-tools")
 (expose "6379")
 (entrypoint "/usr/bin/redis-server")
diff --git a/hack/dockerfiles/generated-files.Dockerfile b/hack/dockerfiles/generated-files.Dockerfile
index 97adfc679273..97262e527659 100644
--- a/hack/dockerfiles/generated-files.Dockerfile
+++ b/hack/dockerfiles/generated-files.Dockerfile
@@ -4,7 +4,7 @@
 FROM golang:1.13-buster AS gobuild-base
 ARG PROTOC_VERSION=3.1.0
 ARG GOGO_VERSION=master
-RUN apt-get update && apt-get install -y \
+RUN apt-get update && apt-get --no-install-recommends install -y \
  git \
  unzip \
  && true
diff --git a/util/binfmt_misc/Dockerfile b/util/binfmt_misc/Dockerfile
index c3abe7bf0195..210355f6f4a6 100644
--- a/util/binfmt_misc/Dockerfile
+++ b/util/binfmt_misc/Dockerfile
@@ -1,5 +1,5 @@
 FROM debian:buster-slim AS base
-RUN apt-get update && apt-get install -y --no-install-recommends \
+RUN apt-get update && apt-get --no-install-recommends install -y \
   binutils-arm-linux-gnueabihf \
   binutils-aarch64-linux-gnu \
   binutils-x86-64-linux-gnu \