I always advocate having custom-built docker images for CI, periodically refreshed for security fixes. CI should not run more than few seconds over the standard time to run the same thing from a dev machine.
However, other people around me are fine with apt installs and pip installs from global mirrors in every CI run. So I may be just autistic.
Yeah, that drives me bonkers. Just set up a separate CI/CD for the images themselves that update daily as needed.
Sure. Although you can expect build/test time to take a while on bigger projects, so I think it washes out a lot of the time.