How do you cut down a Python base image without making it a pain to run?

Take a look at a distroless Python runtime. You can build dependencies in one stage and copy the application and what it needs into the runtime stage, without bringing along the whole build environment.

Check that the runtime includes the Python version and system libraries your dependencies need, especially if you have native extensions. Test the actual image rather than assuming everything copied from the builder will work.

Before removing the shell, figure out how the team will debug a broken container. A minimal image is nice until an incident starts and the usual tools aren't there.

If you're on Kubernetes, kubectl debug or an ephemeral debug container can help. Make sure people know the process and have the access they need before relying on it.

A distro-based image isn't necessarily doing anything wrong here. It trades a lean runtime for familiar tools and broader compatibility, which can make installing and troubleshooting dependencies easier.

Compare the runtime images available for your app and decide whether the smaller footprint is worth changing that workflow. Multi-stage builds help remove build tools, but they don't automatically strip packages from the final base.

Use the scanner output as a starting point, not just a package count contest. Extra packages can add findings and tools an attacker could use, but a smaller image still needs updates and scanning for the dependencies it does ship.