Does it matter whose fault it is when one just needs to ship a product and keep it running reliably? I'm conflicted on this. I'm currently running an Alpine-ba

Does it matter whose fault it is when one just needs to ship a product and keep it running reliably? I'm conflicted on this. I'm currently running an Alpine-based container in production but am thinking about revisiting the choice of base image. On the one hand, using a smaller base system and (especially) a simpler libc translates to a smaller attack surface, and less noise in static scans for vulnerabilities. So I could argue that using Alpine is the responsible choice from a security perspective. But maybe I'm just rationalizing a desire to pursue the kind of software quality (simplicity, minimization of bloat) that only we developers appreciate and that often has hidden downsides. Then I read about such downsides, like the sibling comment about DNS resolution, and I wonder if the responsible thing to do as a pragmatic product developer (and future manager of such developers) is to banish Alpine from the stack, tolerate the relative bloat of something like Debian, and throw more (and more complex) tools at the problem of the larger attack surface and more noise in vulnerability scans.