Keep build tools out of the shipped container image
A container image carrying the whole build toolchain, split so only the finished application ships.
The ticket
Convert a single-stage container image to multi-stage so build tools stay out of the runtime image.
Acceptance criteria
- Build tooling is absent from the final image
- Image size is recorded before and after
- A smoke test passes against the final image
- Runtime dependencies missed by the split are added explicitly
What lands as proof
A smoke test against the slimmed image, since the failure mode is a missing runtime dependency rather than a build error.
Why teams defer it
- The fat image works, so the cost is paid in pull time and attack surface rather than failures.
- Working out which runtime dependencies to carry over is trial and error against a smoke test.
Questions
- What does the agent actually change?
- The ticket is scoped to one outcome: convert a single-stage container image to multi-stage so build tools stay out of the runtime image. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.
- How do I know the work is done?
- The pull request carries the evidence, not only the diff. Here that means image size before and after, so a reviewer can confirm the result without reproducing the work locally.
- How much oversight does this need?
- The run stops once the plan is written. Somebody reads the approach and approves it before any code exists, which is the cheapest moment to redirect the work.