Multi-stage builds

Build in one image, ship another

A multi-stage build compiles in a stage that has the full toolchain, then copies just the output into a clean runtime stage. Compilers, headers, and development dependencies never reach production.

The size difference is often an order of magnitude, and the security difference is larger: a runtime image with no shell and no package manager offers an attacker very little to work with.

Stages can also be targeted directly, so the same Dockerfile can produce a fat development image with hot reloading and a minimal production one.