On one of my docker host with Ubuntu 16.04 running apt-get upgrade I receive the message:
The following packages have been kept back: docker-io
then to upgrade one or all of the kept-back packages, without doing a distribution upgrade (dist-upgrade can be quite dangerous) is to issue the command:
apt-get install <list of packages kept back>
this will resolve the kept-back issues and will ask to install additional packages and dependencies.