A production image contains compilers and build credentials left from an earlier build step. Which build pattern best separates compilation from runtime delivery?

1. Add a Kubernetes namespace to the image name
2. Keep one stage and rename the compiler binary
3. Put build credentials in an image label for easier retrieval
4. Use a multi-stage build and copy only required runtime artifacts into the final stage