A multi-stage build separates artifact preparation from the final runtime filesystem. Give a stage a name, produce or collect the artifact there, then copy only what the release needs into a fresh stage. The build context is the set of files available to Dockerfile instructions. A .dockerignore file removes matching inputs before COPY uses them. An image can specify a nonroot runtime user, and Kubernetes can add container security settings. These controls address different boundaries.
Apply those boundaries to fresh fixtures. Inspect the requested name, namespace, path and value before reusing a command. The tasks mix earlier operations and include nearby wrong targets, so preserve unrelated work. Choose any supported approach that produces the complete requested state; the checker evaluates the result rather than a recorded command sequence.