One addition on the secrets point: a BuildKit secret mount keeps the value out of layers, but it's worth confirming with docker history and by exporting the image that nothing like a .npmrc or pip config got copied in by a broad COPY step, which is where .dockerignore earns its keep. On non-root, a common failure is a read-only root filesystem or volume ownership mismatch once USER is switched, so running the container with --read-only and a tmpfs for the writable paths is a cheap way to find what the app really needs to write. For pinned digests, a CI step that fails when the base image is older than some number of days would stop pinning from quietly turning into never patching. Do you think distroless is worth the debugging cost for teams that don't already have ephemeral debug containers (kubectl debug or docker debug) set up?