docker dudz say to let upstream images upgrade
split keys into separate lines