Size
Ship the output, not the toolchain
A build stage and a runtime stage, `COPY --from`, and why the final image does not inherit what the builder installed.
The compiler you shipped
To build most things you need tools you do not need to run them: a compiler, headers, a package manager's cache, development dependencies. In a single-stage build every one of those is in a layer, and every layer is in the image.
Deleting them afterwards does not help, for the reason the whiteout lesson gave: the bytes are in a layer below and a later instruction can only hide them.
Dockerfile
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
Layers
Nothing has been built yet. Press Build and the layers, the digest and the cache ledger appear — not before.