You need to make sure to always run everything in a single RUN.

This avoids the issue around apt caches being stuck in a layer.

While we are here, save an extraction / layer pull by moving sentry-cli into the previous RUN