Container Registry

Built images. A shared base holds the runtime + common deps; each app is a thin layer FROM it — so apps don't each package a full runtime.