A multi-stage build separates artifact preparation from the final runtime filesystem. Give a stage a name, produce or collect the artifact there, then copy only what the release needs into a fresh stage. The final stage starts with its own base, so tools and temporary files from earlier stages stay out unless you copy them. That boundary can reduce unnecessary image content, but it doesn't automatically audit dependencies or remove a secret already copied into the final stage. These exercises build fictional text artifacts, inspect the final file paths and user, and reject an image that still carries the temporary builder file. One task also compares modeled image size against a measured local baseline, without claiming a vendor download size.