A few substantial changes:

* use a multi-stage Dockerfile, instead of a gitlab-CI setup with
  a dedicated build stage (makes the build more easily reproducible)
* ensures permissions are set correctly in the resulting image