Not just rootless and read-only, but distroless/chiseled too. There's no reason to have unneeded parts of an OS in your Docker containers. It should just be one app along with any libraries it needs (or just statically compile the app)