The thing I've liked about this is that bloat isn't just about size. If you have no reason to interact with the userland tools inside a Docker container, you s

The thing I've liked about this is that bloat isn't just about size. If you have no reason to interact with the userland tools inside a Docker container, you similarly have no reason to introduce their complexity and attack surface in a container designed to run one service. My current "minimal" installation shows 25 SUID binaries (a large amount of them being systemd related...) and my server services need very few of these.