The run image has no shell, no package manager, no debug tools — drastically reducing the attack surface of every Java ...