What does a multi-stage build buy you for a Spring Boot service beyond a smaller image?

The build stage uses a full JDK plus Maven/Gradle to compile, while the final stage starts from a slim JRE and COPY --from=builder pulls only the artifact — so the runtime image is far smaller and, crucially, contains no compiler, build tools, or source code, shrinking the attack surface. For Spring Boot you go further with jarmode=layertools (or Buildpacks) to split the fat jar into dependency, loader, snapshot, and application layers, so rebuilds only re-copy the tiny application layer and the heavy dependency layer stays cached in the registry and on nodes.