diff --git a/examples/fbsd-lite/Cblockfile b/examples/fbsd-lite/Cblockfile
index e652726..10a19ca 100644
--- a/examples/fbsd-lite/Cblockfile
+++ b/examples/fbsd-lite/Cblockfile
@@ -25,7 +25,11 @@ COPY src.conf /usr/src/src-lite.conf
 WORKDIR "/usr/src"
 RUN "make -j $(sysctl -n hw.ncpu) buildworld SRCCONF=/usr/src/src-lite.conf"
 RUN "mkdir -p /new/root"
-RUN "make installworld SRCCONF=/usr/src/src-lite.conf DESTDIR=/new/root"
+#
+# Leave out headers and static libraries -- nothing compiles inside the
+# image. Drop these two if ports or native extensions will be built in the
+# container. They only work here: buildworld fails if they are in src.conf.
+RUN "make installworld SRCCONF=/usr/src/src-lite.conf DESTDIR=/new/root WITHOUT_INCLUDES=yes WITHOUT_INSTALLLIB=yes"
 
 #
 # Prepare /etc
diff --git a/examples/fbsd-lite/src.conf b/examples/fbsd-lite/src.conf
index 393a5be..d2b6baa 100644
--- a/examples/fbsd-lite/src.conf
+++ b/examples/fbsd-lite/src.conf
@@ -8,7 +8,9 @@
 #
 # Usage:
 #   make -j$(sysctl -n hw.ncpu) buildworld SRCCONF=/path/to/src.conf
-#   make installworld distribution SRCCONF=/path/to/src.conf DESTDIR=...
+#   make installworld SRCCONF=/path/to/src.conf DESTDIR=... \
+#       WITHOUT_INCLUDES=yes WITHOUT_INSTALLLIB=yes
+#   make distribution SRCCONF=/path/to/src.conf DESTDIR=...
 #
 
 # Compiler toolchain -- not needed inside a container image. TOOLCHAIN
@@ -18,16 +20,23 @@ WITHOUT_TOOLCHAIN=yes
 WITHOUT_OPENMP=yes
 WITHOUT_GOOGLETEST=yes
 
+# Headers and static libraries are left out at installworld time; see the
+# Cblockfile. WITHOUT_INCLUDES and WITHOUT_INSTALLLIB must not be set here:
+# buildworld installs its own bootstrap headers and libraries (liblegacy.a)
+# and fails without them.
+
 # Documentation
 WITHOUT_MAN=yes
 WITHOUT_HTML=yes
 WITHOUT_DICT=yes
 WITHOUT_EXAMPLES=yes
 WITHOUT_SHAREDOCS=yes
+WITHOUT_MAN_UTILS=yes
 
 # Locales -- pkg does not need them; add WITH_LOCALES if ports require them
 WITHOUT_LOCALES=yes
 WITHOUT_ICONV=yes
+WITHOUT_NLS=yes
 
 # Mail -- MAIL also turns off SENDMAIL, DMAGENT and MAILWRAPPER
 WITHOUT_MAIL=yes
@@ -92,6 +101,8 @@ WITHOUT_PMC=yes
 WITHOUT_LEGACY_CONSOLE=yes
 WITHOUT_SYSCONS=yes
 WITHOUT_VT=yes
+# Wireless firmware in /boot/firmware -- WIRELESS does not cover it
+WITHOUT_SOURCELESS_UCODE=yes
 
 # Installer and updates -- images are rebuilt, not updated in place
 WITHOUT_BSDINSTALL=yes
@@ -116,3 +127,6 @@ WITHOUT_LPR=yes
 WITHOUT_TESTS=yes
 WITHOUT_RESCUE=yes
 WITHOUT_DEBUG_FILES=yes
+# /var/db/services.db -- nsswitch.conf uses "services: files", so libc
+# reads /etc/services directly. /etc/services is still installed.
+WITHOUT_SERVICESDB=yes