while this is "best practice", I'm not sure we actually should stop updating the base image. "ubuntu:bionic" is still at its initial version, right?

We should not update an underling layer, because it simply costs resources in build time and storage. The base image should be always up to date.
The dockerfile uses the official docker image from ubuntu, which is regularly updated. Nevertheless docker use caches so docker may use an older local caches ubuntu base image. To avoid this behavior simply add --pull flag to ensure latest available version.

Should I add the --pull flag to travis script and:

The dockerfile uses the official docker image from ubuntu, which is regularly updated.

Do you have a reference for this?

Docker Hub using old versions of the parent image might be the reason that every dist-upgrade actually upgrades a lot.

You mean?
https://docs.docker.com/docker-hub/official_images/

Ubuntu image:
https://hub.docker.com/_/ubuntu?tab=tags

bionic25.48 MB
Last updated5 days agobydoijanky

Yes, thanks! I also found this: https://anchore.com/look-often-docker-images-updated/
That's seems fine.

Should I add the --pull flag to travis script and:

Yes please!