Five changes separate a throwaway image from a liability

A before/after Dockerfile walkthrough showing the concrete hardening changes that matter most in practice.