> controlling everything over SSH

It just takes some experience. I mostly disable SSH for example. You bake your images once, not install everything on each boot.