Separate your build environment from your runtime image — smaller, safer images with almost no extra effort.