diff --git a/11.0/apache/Dockerfile b/11.0/apache/Dockerfile
index e591916..3e58d7d 100644
--- a/11.0/apache/Dockerfile
+++ b/11.0/apache/Dockerfile
@@ -1,68 +1,90 @@
 FROM php:7.1-apache
 
-RUN apt-get update && apt-get install -y \
-  rsync \
-  bzip2 \
-  libcurl4-openssl-dev \
-  libfreetype6-dev \
-  libicu-dev \
-  libjpeg-dev \
-  libldap2-dev \
-  libmcrypt-dev \
-  libmemcached-dev \
-  libpng12-dev \
-  libpq-dev \
-  libxml2-dev \
-  && rm -rf /var/lib/apt/lists/*
-
-# https://docs.nextcloud.com/server/9/admin_manual/installation/source_installation.html
-RUN debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)" \
-  && docker-php-ext-configure gd --with-png-dir=/usr --with-jpeg-dir=/usr \
-  && docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch" \
-  && docker-php-ext-install gd exif intl mbstring mcrypt ldap mysqli opcache pdo_mysql pdo_pgsql pgsql zip pcntl
-
+RUN set -ex; \
+    apt-get update; \
+# install the packages we need
+    apt-get install -y --no-install-recommends \
+        rsync \
+        bzip2 \
+    ; \
+# install the PHP extensions we need
+# see https://docs.nextcloud.com/server/12/admin_manual/installation/source_installation.html
+    \
+    savedAptMark="$(apt-mark showmanual)"; \
+    \
+    apt-get install -y --no-install-recommends \
+        libcurl4-openssl-dev \
+        libfreetype6-dev \
+        libicu-dev \
+        libjpeg-dev \
+        libldap2-dev \
+        libmcrypt-dev \
+        libmemcached-dev \
+        libpng12-dev \
+        libpq-dev \
+        libxml2-dev \
+    ; \
+    \
+    debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+    docker-php-ext-configure gd --with-png-dir=/usr --with-jpeg-dir=/usr; \
+    docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+    docker-php-ext-install gd exif intl mbstring mcrypt ldap mysqli opcache pdo_mysql pdo_pgsql pgsql zip pcntl; \
+    pecl install APCu-5.1.9; \
+    pecl install memcached-3.0.4; \
+    pecl install redis-3.1.6; \
+    docker-php-ext-enable apcu redis memcached; \
+    \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+    apt-mark auto '.*' > /dev/null; \
+    apt-mark manual $savedAptMark; \
+    ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+        | awk '/=>/ { print $3 }' \
+        | sort -u \
+        | xargs -r dpkg-query -S \
+        | cut -d: -f1 \
+        | sort -u \
+        | xargs -rt apt-mark manual; \
+    \
+    apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+    rm -rf /var/lib/apt/lists/*; \
+    \
 # set recommended PHP.ini settings
 # see https://docs.nextcloud.com/server/12/admin_manual/configuration_server/server_tuning.html#enable-php-opcache
-RUN { \
-  echo 'opcache.enable=1'; \
-  echo 'opcache.enable_cli=1'; \
-  echo 'opcache.interned_strings_buffer=8'; \
-  echo 'opcache.max_accelerated_files=10000'; \
-  echo 'opcache.memory_consumption=128'; \
-  echo 'opcache.save_comments=1'; \
-  echo 'opcache.revalidate_freq=1'; \
-  } > /usr/local/etc/php/conf.d/opcache-recommended.ini
-RUN a2enmod rewrite
+    { \
+        echo 'opcache.enable=1'; \
+        echo 'opcache.enable_cli=1'; \
+        echo 'opcache.interned_strings_buffer=8'; \
+        echo 'opcache.max_accelerated_files=10000'; \
+        echo 'opcache.memory_consumption=128'; \
+        echo 'opcache.save_comments=1'; \
+        echo 'opcache.revalidate_freq=1'; \
+    } > /usr/local/etc/php/conf.d/opcache-recommended.ini; \
+    \
+    chown -R www-data:root /var/www/html; \
+    chmod -R g=u /var/www/html
+
+VOLUME /var/www/html
 
-# PECL extensions
-RUN set -ex \
- && pecl install APCu-5.1.9 \
- && pecl install memcached-3.0.4 \
- && pecl install redis-3.1.6 \
- && docker-php-ext-enable apcu redis memcached
 RUN a2enmod rewrite
 
 ENV NEXTCLOUD_VERSION 11.0.6
 
-RUN chown -R www-data:root /var/www/html && \
-    chmod -R g=u /var/www/html
-VOLUME /var/www/html
-
-RUN curl -fsSL -o nextcloud.tar.bz2 \
-    "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2" \
- && curl -fsSL -o nextcloud.tar.bz2.asc \
-    "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2.asc" \
- && export GNUPGHOME="$(mktemp -d)" \
+RUN set -ex; \
+    curl -fsSL -o nextcloud.tar.bz2 \
+        "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2"; \
+    curl -fsSL -o nextcloud.tar.bz2.asc \
+        "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2.asc"; \
+    export GNUPGHOME="$(mktemp -d)"; \
 # gpg key from https://nextcloud.com/nextcloud.asc
- && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys 28806A878AE423A28372792ED75899B9A724937A \
- && gpg --batch --verify nextcloud.tar.bz2.asc nextcloud.tar.bz2 \
- && rm -r "$GNUPGHOME" nextcloud.tar.bz2.asc \
- && tar -xjf nextcloud.tar.bz2 -C /usr/src/ \
- && rm nextcloud.tar.bz2 \
- && rm -rf /usr/src/nextcloud/updater \
- && mkdir -p /usr/src/nextcloud/data \
- && mkdir -p /usr/src/nextcloud/custom_apps \
- && chmod +x /usr/src/nextcloud/occ
+    gpg --keyserver ha.pool.sks-keyservers.net --recv-keys 28806A878AE423A28372792ED75899B9A724937A; \
+    gpg --batch --verify nextcloud.tar.bz2.asc nextcloud.tar.bz2; \
+    rm -r "$GNUPGHOME" nextcloud.tar.bz2.asc; \
+    tar -xjf nextcloud.tar.bz2 -C /usr/src/; \
+    rm nextcloud.tar.bz2; \
+    rm -rf /usr/src/nextcloud/updater; \
+    mkdir -p /usr/src/nextcloud/data; \
+    mkdir -p /usr/src/nextcloud/custom_apps; \
+    chmod +x /usr/src/nextcloud/occ
 
 COPY docker-entrypoint.sh /entrypoint.sh
 COPY config/* /usr/src/nextcloud/config/
diff --git a/11.0/fpm/Dockerfile b/11.0/fpm/Dockerfile
index 79c928c..78b0007 100644
--- a/11.0/fpm/Dockerfile
+++ b/11.0/fpm/Dockerfile
@@ -1,66 +1,89 @@
 FROM php:7.1-fpm
 
-RUN apt-get update && apt-get install -y \
-  rsync \
-  bzip2 \
-  libcurl4-openssl-dev \
-  libfreetype6-dev \
-  libicu-dev \
-  libjpeg-dev \
-  libldap2-dev \
-  libmcrypt-dev \
-  libmemcached-dev \
-  libpng12-dev \
-  libpq-dev \
-  libxml2-dev \
-  && rm -rf /var/lib/apt/lists/*
-
-# https://docs.nextcloud.com/server/9/admin_manual/installation/source_installation.html
-RUN debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)" \
-  && docker-php-ext-configure gd --with-png-dir=/usr --with-jpeg-dir=/usr \
-  && docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch" \
-  && docker-php-ext-install gd exif intl mbstring mcrypt ldap mysqli opcache pdo_mysql pdo_pgsql pgsql zip pcntl
-
+RUN set -ex; \
+    apt-get update; \
+# install the packages we need
+    apt-get install -y --no-install-recommends \
+        rsync \
+        bzip2 \
+    ; \
+# install the PHP extensions we need
+# see https://docs.nextcloud.com/server/12/admin_manual/installation/source_installation.html
+    \
+    savedAptMark="$(apt-mark showmanual)"; \
+    \
+    apt-get install -y --no-install-recommends \
+        libcurl4-openssl-dev \
+        libfreetype6-dev \
+        libicu-dev \
+        libjpeg-dev \
+        libldap2-dev \
+        libmcrypt-dev \
+        libmemcached-dev \
+        libpng12-dev \
+        libpq-dev \
+        libxml2-dev \
+    ; \
+    \
+    debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+    docker-php-ext-configure gd --with-png-dir=/usr --with-jpeg-dir=/usr; \
+    docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+    docker-php-ext-install gd exif intl mbstring mcrypt ldap mysqli opcache pdo_mysql pdo_pgsql pgsql zip pcntl; \
+    pecl install APCu-5.1.9; \
+    pecl install memcached-3.0.4; \
+    pecl install redis-3.1.6; \
+    docker-php-ext-enable apcu redis memcached; \
+    \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+    apt-mark auto '.*' > /dev/null; \
+    apt-mark manual $savedAptMark; \
+    ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+        | awk '/=>/ { print $3 }' \
+        | sort -u \
+        | xargs -r dpkg-query -S \
+        | cut -d: -f1 \
+        | sort -u \
+        | xargs -rt apt-mark manual; \
+    \
+    apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+    rm -rf /var/lib/apt/lists/*; \
+    \
 # set recommended PHP.ini settings
 # see https://docs.nextcloud.com/server/12/admin_manual/configuration_server/server_tuning.html#enable-php-opcache
-RUN { \
-  echo 'opcache.enable=1'; \
-  echo 'opcache.enable_cli=1'; \
-  echo 'opcache.interned_strings_buffer=8'; \
-  echo 'opcache.max_accelerated_files=10000'; \
-  echo 'opcache.memory_consumption=128'; \
-  echo 'opcache.save_comments=1'; \
-  echo 'opcache.revalidate_freq=1'; \
-  } > /usr/local/etc/php/conf.d/opcache-recommended.ini
+    { \
+        echo 'opcache.enable=1'; \
+        echo 'opcache.enable_cli=1'; \
+        echo 'opcache.interned_strings_buffer=8'; \
+        echo 'opcache.max_accelerated_files=10000'; \
+        echo 'opcache.memory_consumption=128'; \
+        echo 'opcache.save_comments=1'; \
+        echo 'opcache.revalidate_freq=1'; \
+    } > /usr/local/etc/php/conf.d/opcache-recommended.ini; \
+    \
+    chown -R www-data:root /var/www/html; \
+    chmod -R g=u /var/www/html
+
+VOLUME /var/www/html
 
-# PECL extensions
-RUN set -ex \
- && pecl install APCu-5.1.9 \
- && pecl install memcached-3.0.4 \
- && pecl install redis-3.1.6 \
- && docker-php-ext-enable apcu redis memcached
 
 ENV NEXTCLOUD_VERSION 11.0.6
 
-RUN chown -R www-data:root /var/www/html && \
-    chmod -R g=u /var/www/html
-VOLUME /var/www/html
-
-RUN curl -fsSL -o nextcloud.tar.bz2 \
-    "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2" \
- && curl -fsSL -o nextcloud.tar.bz2.asc \
-    "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2.asc" \
- && export GNUPGHOME="$(mktemp -d)" \
+RUN set -ex; \
+    curl -fsSL -o nextcloud.tar.bz2 \
+        "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2"; \
+    curl -fsSL -o nextcloud.tar.bz2.asc \
+        "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2.asc"; \
+    export GNUPGHOME="$(mktemp -d)"; \
 # gpg key from https://nextcloud.com/nextcloud.asc
- && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys 28806A878AE423A28372792ED75899B9A724937A \
- && gpg --batch --verify nextcloud.tar.bz2.asc nextcloud.tar.bz2 \
- && rm -r "$GNUPGHOME" nextcloud.tar.bz2.asc \
- && tar -xjf nextcloud.tar.bz2 -C /usr/src/ \
- && rm nextcloud.tar.bz2 \
- && rm -rf /usr/src/nextcloud/updater \
- && mkdir -p /usr/src/nextcloud/data \
- && mkdir -p /usr/src/nextcloud/custom_apps \
- && chmod +x /usr/src/nextcloud/occ
+    gpg --keyserver ha.pool.sks-keyservers.net --recv-keys 28806A878AE423A28372792ED75899B9A724937A; \
+    gpg --batch --verify nextcloud.tar.bz2.asc nextcloud.tar.bz2; \
+    rm -r "$GNUPGHOME" nextcloud.tar.bz2.asc; \
+    tar -xjf nextcloud.tar.bz2 -C /usr/src/; \
+    rm nextcloud.tar.bz2; \
+    rm -rf /usr/src/nextcloud/updater; \
+    mkdir -p /usr/src/nextcloud/data; \
+    mkdir -p /usr/src/nextcloud/custom_apps; \
+    chmod +x /usr/src/nextcloud/occ
 
 COPY docker-entrypoint.sh /entrypoint.sh
 COPY config/* /usr/src/nextcloud/config/
diff --git a/12.0/apache/Dockerfile b/12.0/apache/Dockerfile
index 91b7bad..5538113 100644
--- a/12.0/apache/Dockerfile
+++ b/12.0/apache/Dockerfile
@@ -1,68 +1,90 @@
 FROM php:7.1-apache
 
-RUN apt-get update && apt-get install -y \
-  rsync \
-  bzip2 \
-  libcurl4-openssl-dev \
-  libfreetype6-dev \
-  libicu-dev \
-  libjpeg-dev \
-  libldap2-dev \
-  libmcrypt-dev \
-  libmemcached-dev \
-  libpng12-dev \
-  libpq-dev \
-  libxml2-dev \
-  && rm -rf /var/lib/apt/lists/*
-
-# https://docs.nextcloud.com/server/9/admin_manual/installation/source_installation.html
-RUN debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)" \
-  && docker-php-ext-configure gd --with-png-dir=/usr --with-jpeg-dir=/usr \
-  && docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch" \
-  && docker-php-ext-install gd exif intl mbstring mcrypt ldap mysqli opcache pdo_mysql pdo_pgsql pgsql zip pcntl
-
+RUN set -ex; \
+    apt-get update; \
+# install the packages we need
+    apt-get install -y --no-install-recommends \
+        rsync \
+        bzip2 \
+    ; \
+# install the PHP extensions we need
+# see https://docs.nextcloud.com/server/12/admin_manual/installation/source_installation.html
+    \
+    savedAptMark="$(apt-mark showmanual)"; \
+    \
+    apt-get install -y --no-install-recommends \
+        libcurl4-openssl-dev \
+        libfreetype6-dev \
+        libicu-dev \
+        libjpeg-dev \
+        libldap2-dev \
+        libmcrypt-dev \
+        libmemcached-dev \
+        libpng12-dev \
+        libpq-dev \
+        libxml2-dev \
+    ; \
+    \
+    debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+    docker-php-ext-configure gd --with-png-dir=/usr --with-jpeg-dir=/usr; \
+    docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+    docker-php-ext-install gd exif intl mbstring mcrypt ldap mysqli opcache pdo_mysql pdo_pgsql pgsql zip pcntl; \
+    pecl install APCu-5.1.9; \
+    pecl install memcached-3.0.4; \
+    pecl install redis-3.1.6; \
+    docker-php-ext-enable apcu redis memcached; \
+    \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+    apt-mark auto '.*' > /dev/null; \
+    apt-mark manual $savedAptMark; \
+    ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+        | awk '/=>/ { print $3 }' \
+        | sort -u \
+        | xargs -r dpkg-query -S \
+        | cut -d: -f1 \
+        | sort -u \
+        | xargs -rt apt-mark manual; \
+    \
+    apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+    rm -rf /var/lib/apt/lists/*; \
+    \
 # set recommended PHP.ini settings
 # see https://docs.nextcloud.com/server/12/admin_manual/configuration_server/server_tuning.html#enable-php-opcache
-RUN { \
-  echo 'opcache.enable=1'; \
-  echo 'opcache.enable_cli=1'; \
-  echo 'opcache.interned_strings_buffer=8'; \
-  echo 'opcache.max_accelerated_files=10000'; \
-  echo 'opcache.memory_consumption=128'; \
-  echo 'opcache.save_comments=1'; \
-  echo 'opcache.revalidate_freq=1'; \
-  } > /usr/local/etc/php/conf.d/opcache-recommended.ini
-RUN a2enmod rewrite
+    { \
+        echo 'opcache.enable=1'; \
+        echo 'opcache.enable_cli=1'; \
+        echo 'opcache.interned_strings_buffer=8'; \
+        echo 'opcache.max_accelerated_files=10000'; \
+        echo 'opcache.memory_consumption=128'; \
+        echo 'opcache.save_comments=1'; \
+        echo 'opcache.revalidate_freq=1'; \
+    } > /usr/local/etc/php/conf.d/opcache-recommended.ini; \
+    \
+    chown -R www-data:root /var/www/html; \
+    chmod -R g=u /var/www/html
+
+VOLUME /var/www/html
 
-# PECL extensions
-RUN set -ex \
- && pecl install APCu-5.1.9 \
- && pecl install memcached-3.0.4 \
- && pecl install redis-3.1.6 \
- && docker-php-ext-enable apcu redis memcached
 RUN a2enmod rewrite
 
 ENV NEXTCLOUD_VERSION 12.0.4
 
-RUN chown -R www-data:root /var/www/html && \
-    chmod -R g=u /var/www/html
-VOLUME /var/www/html
-
-RUN curl -fsSL -o nextcloud.tar.bz2 \
-    "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2" \
- && curl -fsSL -o nextcloud.tar.bz2.asc \
-    "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2.asc" \
- && export GNUPGHOME="$(mktemp -d)" \
+RUN set -ex; \
+    curl -fsSL -o nextcloud.tar.bz2 \
+        "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2"; \
+    curl -fsSL -o nextcloud.tar.bz2.asc \
+        "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2.asc"; \
+    export GNUPGHOME="$(mktemp -d)"; \
 # gpg key from https://nextcloud.com/nextcloud.asc
- && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys 28806A878AE423A28372792ED75899B9A724937A \
- && gpg --batch --verify nextcloud.tar.bz2.asc nextcloud.tar.bz2 \
- && rm -r "$GNUPGHOME" nextcloud.tar.bz2.asc \
- && tar -xjf nextcloud.tar.bz2 -C /usr/src/ \
- && rm nextcloud.tar.bz2 \
- && rm -rf /usr/src/nextcloud/updater \
- && mkdir -p /usr/src/nextcloud/data \
- && mkdir -p /usr/src/nextcloud/custom_apps \
- && chmod +x /usr/src/nextcloud/occ
+    gpg --keyserver ha.pool.sks-keyservers.net --recv-keys 28806A878AE423A28372792ED75899B9A724937A; \
+    gpg --batch --verify nextcloud.tar.bz2.asc nextcloud.tar.bz2; \
+    rm -r "$GNUPGHOME" nextcloud.tar.bz2.asc; \
+    tar -xjf nextcloud.tar.bz2 -C /usr/src/; \
+    rm nextcloud.tar.bz2; \
+    rm -rf /usr/src/nextcloud/updater; \
+    mkdir -p /usr/src/nextcloud/data; \
+    mkdir -p /usr/src/nextcloud/custom_apps; \
+    chmod +x /usr/src/nextcloud/occ
 
 COPY docker-entrypoint.sh /entrypoint.sh
 COPY config/* /usr/src/nextcloud/config/
diff --git a/12.0/fpm/Dockerfile b/12.0/fpm/Dockerfile
index 0b7f23f..0cdcee5 100644
--- a/12.0/fpm/Dockerfile
+++ b/12.0/fpm/Dockerfile
@@ -1,66 +1,89 @@
 FROM php:7.1-fpm
 
-RUN apt-get update && apt-get install -y \
-  rsync \
-  bzip2 \
-  libcurl4-openssl-dev \
-  libfreetype6-dev \
-  libicu-dev \
-  libjpeg-dev \
-  libldap2-dev \
-  libmcrypt-dev \
-  libmemcached-dev \
-  libpng12-dev \
-  libpq-dev \
-  libxml2-dev \
-  && rm -rf /var/lib/apt/lists/*
-
-# https://docs.nextcloud.com/server/9/admin_manual/installation/source_installation.html
-RUN debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)" \
-  && docker-php-ext-configure gd --with-png-dir=/usr --with-jpeg-dir=/usr \
-  && docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch" \
-  && docker-php-ext-install gd exif intl mbstring mcrypt ldap mysqli opcache pdo_mysql pdo_pgsql pgsql zip pcntl
-
+RUN set -ex; \
+    apt-get update; \
+# install the packages we need
+    apt-get install -y --no-install-recommends \
+        rsync \
+        bzip2 \
+    ; \
+# install the PHP extensions we need
+# see https://docs.nextcloud.com/server/12/admin_manual/installation/source_installation.html
+    \
+    savedAptMark="$(apt-mark showmanual)"; \
+    \
+    apt-get install -y --no-install-recommends \
+        libcurl4-openssl-dev \
+        libfreetype6-dev \
+        libicu-dev \
+        libjpeg-dev \
+        libldap2-dev \
+        libmcrypt-dev \
+        libmemcached-dev \
+        libpng12-dev \
+        libpq-dev \
+        libxml2-dev \
+    ; \
+    \
+    debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+    docker-php-ext-configure gd --with-png-dir=/usr --with-jpeg-dir=/usr; \
+    docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+    docker-php-ext-install gd exif intl mbstring mcrypt ldap mysqli opcache pdo_mysql pdo_pgsql pgsql zip pcntl; \
+    pecl install APCu-5.1.9; \
+    pecl install memcached-3.0.4; \
+    pecl install redis-3.1.6; \
+    docker-php-ext-enable apcu redis memcached; \
+    \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+    apt-mark auto '.*' > /dev/null; \
+    apt-mark manual $savedAptMark; \
+    ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+        | awk '/=>/ { print $3 }' \
+        | sort -u \
+        | xargs -r dpkg-query -S \
+        | cut -d: -f1 \
+        | sort -u \
+        | xargs -rt apt-mark manual; \
+    \
+    apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+    rm -rf /var/lib/apt/lists/*; \
+    \
 # set recommended PHP.ini settings
 # see https://docs.nextcloud.com/server/12/admin_manual/configuration_server/server_tuning.html#enable-php-opcache
-RUN { \
-  echo 'opcache.enable=1'; \
-  echo 'opcache.enable_cli=1'; \
-  echo 'opcache.interned_strings_buffer=8'; \
-  echo 'opcache.max_accelerated_files=10000'; \
-  echo 'opcache.memory_consumption=128'; \
-  echo 'opcache.save_comments=1'; \
-  echo 'opcache.revalidate_freq=1'; \
-  } > /usr/local/etc/php/conf.d/opcache-recommended.ini
+    { \
+        echo 'opcache.enable=1'; \
+        echo 'opcache.enable_cli=1'; \
+        echo 'opcache.interned_strings_buffer=8'; \
+        echo 'opcache.max_accelerated_files=10000'; \
+        echo 'opcache.memory_consumption=128'; \
+        echo 'opcache.save_comments=1'; \
+        echo 'opcache.revalidate_freq=1'; \
+    } > /usr/local/etc/php/conf.d/opcache-recommended.ini; \
+    \
+    chown -R www-data:root /var/www/html; \
+    chmod -R g=u /var/www/html
+
+VOLUME /var/www/html
 
-# PECL extensions
-RUN set -ex \
- && pecl install APCu-5.1.9 \
- && pecl install memcached-3.0.4 \
- && pecl install redis-3.1.6 \
- && docker-php-ext-enable apcu redis memcached
 
 ENV NEXTCLOUD_VERSION 12.0.4
 
-RUN chown -R www-data:root /var/www/html && \
-    chmod -R g=u /var/www/html
-VOLUME /var/www/html
-
-RUN curl -fsSL -o nextcloud.tar.bz2 \
-    "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2" \
- && curl -fsSL -o nextcloud.tar.bz2.asc \
-    "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2.asc" \
- && export GNUPGHOME="$(mktemp -d)" \
+RUN set -ex; \
+    curl -fsSL -o nextcloud.tar.bz2 \
+        "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2"; \
+    curl -fsSL -o nextcloud.tar.bz2.asc \
+        "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2.asc"; \
+    export GNUPGHOME="$(mktemp -d)"; \
 # gpg key from https://nextcloud.com/nextcloud.asc
- && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys 28806A878AE423A28372792ED75899B9A724937A \
- && gpg --batch --verify nextcloud.tar.bz2.asc nextcloud.tar.bz2 \
- && rm -r "$GNUPGHOME" nextcloud.tar.bz2.asc \
- && tar -xjf nextcloud.tar.bz2 -C /usr/src/ \
- && rm nextcloud.tar.bz2 \
- && rm -rf /usr/src/nextcloud/updater \
- && mkdir -p /usr/src/nextcloud/data \
- && mkdir -p /usr/src/nextcloud/custom_apps \
- && chmod +x /usr/src/nextcloud/occ
+    gpg --keyserver ha.pool.sks-keyservers.net --recv-keys 28806A878AE423A28372792ED75899B9A724937A; \
+    gpg --batch --verify nextcloud.tar.bz2.asc nextcloud.tar.bz2; \
+    rm -r "$GNUPGHOME" nextcloud.tar.bz2.asc; \
+    tar -xjf nextcloud.tar.bz2 -C /usr/src/; \
+    rm nextcloud.tar.bz2; \
+    rm -rf /usr/src/nextcloud/updater; \
+    mkdir -p /usr/src/nextcloud/data; \
+    mkdir -p /usr/src/nextcloud/custom_apps; \
+    chmod +x /usr/src/nextcloud/occ
 
 COPY docker-entrypoint.sh /entrypoint.sh
 COPY config/* /usr/src/nextcloud/config/
diff --git a/Dockerfile.template b/Dockerfile.template
index 0ec6bf3..f0d8bc8 100644
--- a/Dockerfile.template
+++ b/Dockerfile.template
@@ -1,68 +1,89 @@
 FROM php:7.1-%%VARIANT%%
 
-RUN apt-get update && apt-get install -y \
-  rsync \
-  bzip2 \
-  libcurl4-openssl-dev \
-  libfreetype6-dev \
-  libicu-dev \
-  libjpeg-dev \
-  libldap2-dev \
-  libmcrypt-dev \
-  libmemcached-dev \
-  libpng12-dev \
-  libpq-dev \
-  libxml2-dev \
-  && rm -rf /var/lib/apt/lists/*
-
-# https://docs.nextcloud.com/server/9/admin_manual/installation/source_installation.html
-RUN debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)" \
-  && docker-php-ext-configure gd --with-png-dir=/usr --with-jpeg-dir=/usr \
-  && docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch" \
-  && docker-php-ext-install gd exif intl mbstring mcrypt ldap mysqli opcache pdo_mysql pdo_pgsql pgsql zip pcntl
-
+RUN set -ex; \
+    apt-get update; \
+# install the packages we need
+    apt-get install -y --no-install-recommends \
+        rsync \
+        bzip2 \
+    ; \
+# install the PHP extensions we need
+# see https://docs.nextcloud.com/server/12/admin_manual/installation/source_installation.html
+    \
+    savedAptMark="$(apt-mark showmanual)"; \
+    \
+    apt-get install -y --no-install-recommends \
+        libcurl4-openssl-dev \
+        libfreetype6-dev \
+        libicu-dev \
+        libjpeg-dev \
+        libldap2-dev \
+        libmcrypt-dev \
+        libmemcached-dev \
+        libpng12-dev \
+        libpq-dev \
+        libxml2-dev \
+    ; \
+    \
+    debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
+    docker-php-ext-configure gd --with-png-dir=/usr --with-jpeg-dir=/usr; \
+    docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch"; \
+    docker-php-ext-install gd exif intl mbstring mcrypt ldap mysqli opcache pdo_mysql pdo_pgsql pgsql zip pcntl; \
+    pecl install APCu-5.1.9; \
+    pecl install memcached-3.0.4; \
+    pecl install redis-3.1.6; \
+    docker-php-ext-enable apcu redis memcached; \
+    \
+# reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+    apt-mark auto '.*' > /dev/null; \
+    apt-mark manual $savedAptMark; \
+    ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+        | awk '/=>/ { print $3 }' \
+        | sort -u \
+        | xargs -r dpkg-query -S \
+        | cut -d: -f1 \
+        | sort -u \
+        | xargs -rt apt-mark manual; \
+    \
+    apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+    rm -rf /var/lib/apt/lists/*; \
+    \
 # set recommended PHP.ini settings
 # see https://docs.nextcloud.com/server/12/admin_manual/configuration_server/server_tuning.html#enable-php-opcache
-RUN { \
-  echo 'opcache.enable=1'; \
-  echo 'opcache.enable_cli=1'; \
-  echo 'opcache.interned_strings_buffer=8'; \
-  echo 'opcache.max_accelerated_files=10000'; \
-  echo 'opcache.memory_consumption=128'; \
-  echo 'opcache.save_comments=1'; \
-  echo 'opcache.revalidate_freq=1'; \
-  } > /usr/local/etc/php/conf.d/opcache-recommended.ini
-RUN a2enmod rewrite
+    { \
+        echo 'opcache.enable=1'; \
+        echo 'opcache.enable_cli=1'; \
+        echo 'opcache.interned_strings_buffer=8'; \
+        echo 'opcache.max_accelerated_files=10000'; \
+        echo 'opcache.memory_consumption=128'; \
+        echo 'opcache.save_comments=1'; \
+        echo 'opcache.revalidate_freq=1'; \
+    } > /usr/local/etc/php/conf.d/opcache-recommended.ini; \
+    \
+    chown -R www-data:root /var/www/html; \
+    chmod -R g=u /var/www/html
 
-# PECL extensions
-RUN set -ex \
- && pecl install APCu-5.1.9 \
- && pecl install memcached-3.0.4 \
- && pecl install redis-3.1.6 \
- && docker-php-ext-enable apcu redis memcached
-RUN a2enmod rewrite
+VOLUME /var/www/html
+%%VARIANT_EXTRAS%%
 
 ENV NEXTCLOUD_VERSION %%VERSION%%
 
-RUN chown -R www-data:root /var/www/html && \
-    chmod -R g=u /var/www/html
-VOLUME /var/www/html
-
-RUN curl -fsSL -o nextcloud.tar.bz2 \
-    "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2" \
- && curl -fsSL -o nextcloud.tar.bz2.asc \
-    "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2.asc" \
- && export GNUPGHOME="$(mktemp -d)" \
+RUN set -ex; \
+    curl -fsSL -o nextcloud.tar.bz2 \
+        "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2"; \
+    curl -fsSL -o nextcloud.tar.bz2.asc \
+        "https://download.nextcloud.com/server/releases/nextcloud-${NEXTCLOUD_VERSION}.tar.bz2.asc"; \
+    export GNUPGHOME="$(mktemp -d)"; \
 # gpg key from https://nextcloud.com/nextcloud.asc
- && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys 28806A878AE423A28372792ED75899B9A724937A \
- && gpg --batch --verify nextcloud.tar.bz2.asc nextcloud.tar.bz2 \
- && rm -r "$GNUPGHOME" nextcloud.tar.bz2.asc \
- && tar -xjf nextcloud.tar.bz2 -C /usr/src/ \
- && rm nextcloud.tar.bz2 \
- && rm -rf /usr/src/nextcloud/updater \
- && mkdir -p /usr/src/nextcloud/data \
- && mkdir -p /usr/src/nextcloud/custom_apps \
- && chmod +x /usr/src/nextcloud/occ
+    gpg --keyserver ha.pool.sks-keyservers.net --recv-keys 28806A878AE423A28372792ED75899B9A724937A; \
+    gpg --batch --verify nextcloud.tar.bz2.asc nextcloud.tar.bz2; \
+    rm -r "$GNUPGHOME" nextcloud.tar.bz2.asc; \
+    tar -xjf nextcloud.tar.bz2 -C /usr/src/; \
+    rm nextcloud.tar.bz2; \
+    rm -rf /usr/src/nextcloud/updater; \
+    mkdir -p /usr/src/nextcloud/data; \
+    mkdir -p /usr/src/nextcloud/custom_apps; \
+    chmod +x /usr/src/nextcloud/occ
 
 COPY docker-entrypoint.sh /entrypoint.sh
 COPY config/* /usr/src/nextcloud/config/
diff --git a/update.sh b/update.sh
index 6ed577f..2920d07 100755
--- a/update.sh
+++ b/update.sh
@@ -6,6 +6,11 @@ declare -A cmd=(
 	[fpm]='php-fpm'
 )
 
+declare -A extras=(
+	[apache]='\nRUN a2enmod rewrite'
+	[fpm]=''
+)
+
 # version_greater_or_equal A B returns whether A >= B
 function version_greater_or_equal() {
 	[[ "$(printf '%s\n' "$@" | sort -V | head -n 1)" != "$1" || "$1" == "$2" ]];
@@ -43,6 +48,7 @@ for latest in "${latests[@]}"; do
 				s/%%VARIANT%%/'"$variant"'/g;
 				s/%%VERSION%%/'"$latest"'/g;
 				s/%%CMD%%/'"${cmd[$variant]}"'/g;
+				s/%%VARIANT_EXTRAS%%/'"${extras[$variant]}"'/g;
 			' "$version/$variant/Dockerfile"
 
 			# Copy the docker-entrypoint.
@@ -51,9 +57,8 @@ for latest in "${latests[@]}"; do
 			# Copy the config directory
 			cp -rT .config "$version/$variant/config"
 
-			# Remove Apache commands and configs if we're not an Apache variant.
+			# Remove Apache config if we're not an Apache variant.
 			if [ "$variant" != "apache" ]; then
-				sed -ri -e '/a2enmod/d' "$version/$variant/Dockerfile"
 				rm "$version/$variant/config/apache-pretty-urls.config.php"
 			fi