diff --git a/libcxx/utils/ci/Dockerfile b/libcxx/utils/ci/Dockerfile
--- a/libcxx/utils/ci/Dockerfile
+++ b/libcxx/utils/ci/Dockerfile
@@ -59,35 +59,50 @@
 # 14 release branch CI uses it. The tip-of-trunk CI will never use Clang 12,
 # though.
 ENV LLVM_HEAD_VERSION=17
-RUN apt-get update && apt-get install -y lsb-release wget software-properties-common
-RUN wget https://apt.llvm.org/llvm.sh -O /tmp/llvm.sh
-RUN bash /tmp/llvm.sh $(($LLVM_HEAD_VERSION - 3)) # for CI transitions
-RUN bash /tmp/llvm.sh $(($LLVM_HEAD_VERSION - 2)) # previous release
-RUN bash /tmp/llvm.sh $(($LLVM_HEAD_VERSION - 1)) # latest release
-RUN bash /tmp/llvm.sh $LLVM_HEAD_VERSION          # current ToT
-
-# Install clang-format; always use the lastest stable branch.
-RUN apt-get update && apt-get install -y clang-format-$(($LLVM_HEAD_VERSION - 2)) clang-format-$(($LLVM_HEAD_VERSION - 1))
-
-# Install clang-tidy
-RUN apt-get update && apt-get install -y clang-tidy-$(($LLVM_HEAD_VERSION - 2)) clang-tidy-$((LLVM_HEAD_VERSION - 1))
-
-# Install llvm-dev and libclang-dev to compile custom clang-tidy checks
-RUN apt-get update && apt-get install -y llvm-$(($LLVM_HEAD_VERSION - 1))-dev     llvm-$(($LLVM_HEAD_VERSION - 2))-dev \
-                                     libclang-$(($LLVM_HEAD_VERSION - 1))-dev libclang-$(($LLVM_HEAD_VERSION - 2))-dev
-
-# TODO LLVM16 Don't install llvm-16-dev explicitly
-RUN apt-get update && apt-get install -y llvm-16-dev libclang-16-dev
+RUN apt-get update && \
+    apt-get install -y lsb-release wget software-properties-common && \
+    wget https://apt.llvm.org/llvm.sh -O /tmp/llvm.sh && \
+    # for CI transitions
+    bash /tmp/llvm.sh $(($LLVM_HEAD_VERSION - 3)) && \
+    # previous release
+    bash /tmp/llvm.sh $(($LLVM_HEAD_VERSION - 2)) && \
+    # latest release
+    bash /tmp/llvm.sh $(($LLVM_HEAD_VERSION - 1)) && \
+    # current ToT
+    bash /tmp/llvm.sh $LLVM_HEAD_VERSION && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN apt-get update && \
+    apt-get install -y \
+        # Install clang-format; always use the lastest stable branch.
+        clang-format-$(($LLVM_HEAD_VERSION - 2)) \
+        clang-format-$(($LLVM_HEAD_VERSION - 1)) \
+        # Install clang-tidy; always use the lastest stable branch.
+        clang-tidy-$(($LLVM_HEAD_VERSION - 2)) \
+        clang-tidy-$((LLVM_HEAD_VERSION - 1)) \
+        # Install llvm-dev and libclang-dev to compile custom clang-tidy checks; always use the lastest stable branch.
+        llvm-$(($LLVM_HEAD_VERSION - 1))-dev \
+        llvm-$(($LLVM_HEAD_VERSION - 2))-dev \
+        libclang-$(($LLVM_HEAD_VERSION - 1))-dev \
+        libclang-$(($LLVM_HEAD_VERSION - 2))-dev \
+    && \
+    rm -rf /var/lib/apt/lists/*
 
 # Install the most recent GCC, like clang install the previous version as a transition.
 ENV GCC_LATEST_VERSION=12
-RUN apt-get update && apt install -y gcc-$((GCC_LATEST_VERSION - 1)) g++-$((GCC_LATEST_VERSION - 1))
-RUN apt-get update && apt install -y gcc-$GCC_LATEST_VERSION g++-$GCC_LATEST_VERSION
+RUN apt-get update && \
+    apt install -y \
+        gcc-$((GCC_LATEST_VERSION - 1)) \
+        g++-$((GCC_LATEST_VERSION - 1)) \
+        gcc-$GCC_LATEST_VERSION \
+        g++-$GCC_LATEST_VERSION \
+    && \
+    rm -rf /var/lib/apt/lists/*
 
 # Install a recent CMake
-RUN wget https://github.com/Kitware/CMake/releases/download/v3.21.1/cmake-3.21.1-linux-x86_64.sh -O /tmp/install-cmake.sh
-RUN bash /tmp/install-cmake.sh --prefix=/usr --exclude-subdir --skip-license
-RUN rm /tmp/install-cmake.sh
+RUN wget https://github.com/Kitware/CMake/releases/download/v3.21.1/cmake-3.21.1-linux-x86_64.sh -O /tmp/install-cmake.sh && \
+    bash /tmp/install-cmake.sh --prefix=/usr --exclude-subdir --skip-license && \
+    rm /tmp/install-cmake.sh
 
 # Change the user to a non-root user, since some of the libc++ tests
 # (e.g. filesystem) require running as non-root. Also setup passwordless sudo.