We need ca-certificates at runtime so just do a single stage image
draft default tip
2019-05-25, Gary Kramlich