Most people say multi-stage builds are for smaller images.
Wrong. They’re about attack surface.
FROM mcr.microsoft.com/dotnet/sdk AS build WORKDIR /src COPY . . RUN dotnet publish -c Release -o /app FROM mcr.microsoft.com/dotnet/aspnet WORKDIR /app COPY --from=build /app .
Why it matters:
-
No SDK in production
-
Fewer CVEs
-
Faster cold starts
Smaller image is just a side effect.