I'd rather we lock this down to 3.18 or even 3 just to avoid major updates.

In scripts, including stuff like dockerfiles, I prefer if we use the long arguments. They're usually self explanatory and don't require lookup and are only typed once so theres no reason to take a shortcut.
Also you're telling it to not use a cache but to also update a cache, that seems wrong espeically since the other adds aren't using the cache either.
Preferrably this should just use --update-cache in upgrade which is run first (although I'm not sure why this is even necessary, alpine images aren't usually more than a day behind), remove all the --no-caches, and finally manually delete the cache at the end of the run.

should be 2 lines and rm -rf /var/cache/apk is a bit safer.