Distroless works well. Still no shell, but comes with “what’s usually missing in scratch”.