Platform & DevOps·Packaging: containers and images
the compiler, the test framework and the whole toolchain are used in the build and then thrown away, and the shipped image contains one binary.
Multi-stage build
Also calledbuilder pattern, multi-stage Dockerfile
A build file with more than one FROM, where an early stage does the compiling and a later stage copies only the finished artefact into a clean base. It shrinks images by an order of magnitude and, more importantly, removes the build tooling from production, so a compromised container has no compiler to work with. It is the standard answer to the eight-hundred-megabyte image that ships a package manager to production.