What is the problem with this Dockerfile when you later add a new package to the second line and rebuild?

The cached apt-get update layer is reused, so the install can use old package lists. RUN is cached by its command text. The apt-get update line did not change, so Docker reuses it from an old build. Only the install line runs again, against outdated lists. It can fail, or install old versions.

"Nothing; the cache is invalidated for both lines whenever any line changes" is wrong. A change only rebuilds that step and the steps after it, not the steps before it.

The fix is to combine them in one instruction: RUN apt-get update && apt-get install -y .... Then they are always cached and invalidated together.