Last year I wrote about distroless containers and finished with a small brag: I build my own minimal base image with apko and Wolfi, look how tiny it is, look how few packages it has.

This year I held that image against the standards that serious hardened-image vendors compete on. It failed.

Not because of what was inside the image. The contents were fine. Six packages, no shell, non-root user, signed with Cosign. It failed because of everything around the image and that is exactly where the state of the art has moved.