docker stage separation: build & runtime

Dockerfile

@@ -8,11 +8,24 @@ RUN apk add --no-cache \
     make \
     pkgconf
 
-RUN apk add --no-cache fuse `# convenient`
-
 RUN adduser -S build
 USER build
 
 COPY --chown=build:nogroup . /rgpgfs
 WORKDIR /rgpgfs
 RUN make
+
+
+FROM alpine:3.9
+
+RUN apk add --no-cache \
+    fuse3 \
+    gpgme
+
+# optional, contains fusermount
+RUN apk add --no-cache fuse
+
+RUN adduser -S encrypt
+USER encrypt
+
+COPY --from=build /rgpgfs/rgpgfs /usr/local/bin/