apt-get upgrade is not necessary in Dockerfiles

cf. http://crosbymichael.com/dockerfile-best-practices-take-2.html
Updates will be baked into the based images you don't need to apt-get upgrade your containers. Because of the isolation that happens this can often fail if something is trying to modify init or make device changes inside a container. It also produces inconsistent images because you no longer have one source of truth of how your application should run and what versions of dependencies are included in the image.
If there are security updates that a base image needs, let upstream know so that they can update it for everyone and ensure that your builds are consistent again.
Use sh instead of bash so it is compatible with tiny core linux
The maximum_object_size has to go before cache_dir in order to apply for disk cache.

cf. http://www.mail-archive.com/squid-users@squid-cache.org/msg95131.html
Simplifying the refresh_patterns