Best practice for slimming an image containing a Python application and some ad hoc binaries

[usrme]

I wanted to take a python:3.10.8-alpine3.16-based image into which I've also installed Azure CLI via pip, bash, coreutils, AzCopy, and a random shell script and I thought I did everything as I was supposed to, but while the resulting image was slightly smaller than the original one (307MB vs. 291MB) it didn't actually work properly when trying to run the same commands as I "seeded" the minified build with.

First I created a small shell script that docker-slim would run in the container, which I gathered was necessary for the program to know what all the relevant executables/libraries are, called slim-exec.sh:

#!/bin/bash

az --version
azcopy --version
./script.sh --version

az login <actual options and values>
./script.sh <actual options and values>

Then I ran docker-slim as follows:

docker-slim build \
    --http-probe=false \
    --continue-after=exec \
    --include-shell \
    --include-bin=/bin/bash \
    --include-bin=/opt/azcopy/azcopy \
    --include-bin=/usr/local/bin/az \
    --include-path=/usr/local/lib/python3.10 \
    --include-path=/script.sh \
    --exec-file=slim-exec.sh \
    --target=registry/existing-image:latest

Since it's just a container that contains a bunch of things and serves as an utility image to be used within CI systems I seemingly had no need for HTTP probes (hence the false). Since the script.sh script is written for Bash I am including the shell, the /bin/bash binary, along with AzCopy's binary, and also the az binary, which most likely isn't a binary due to it being installed through pip, which is also why I included the /usr/local/lib/python3.10 path to be sure.

The entire build was successful in that all the executions worked and script.sh did its thing, but when I did docker run on the created image and tried to run the commands again I got errors all over the place relating to Python not finding package X, Y or Z. I'm clearly going about this the wrong way, so I'm hoping someone else has already gone down the path of creating a utility image as well and can help me. I considered putting the installation of Azure CLI into a virtual environment and including its path for docker-slim build, but am not sure if that's conceptually the right move.

Here is the Dockerfile I am basing all of this off of and script.sh can be considered to call the azcopy executable and various commands under the az umbrella like az login, az rest, az disk etc. Pay no mind to the pared down installation of Azure CLI as that was just done to further slim down the build and should not have any impact on the minification procedure:

# https://github.com/Azure/azure-cli/issues/19591
# Python 3.11 isn't yet supported by Azure CLI
FROM python:3.10.8-alpine3.16

# https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10#download-azcopy
#
# curl -sLI https://aka.ms/downloadazcopy-v10-linux | grep "Location"
# -s: silent or quiet mode
# -L: follow redirections
# -I: fetch headers only
#
# These two need to be changed simultaneously, so follow
# the 'curl' command above to get up-to-date values
ARG AZ_COPY_RELEASE=release20221108
ARG AZ_COPY_VERSION=10.16.2

ENV PATH="/opt/azcopy:${PATH}" \
    PIP_DEFAULT_TIMEOUT=100 \
    PIP_DISABLE_PIP_VERSION_CHECK=on \
    PIP_NO_CACHE_DIR=off \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

# Virtual (i.e. named 'build') packages installed with
# 'apk add' are required to install any Azure CLI
# dependencies and are removed afterwards with 'apk del'
#
# Despite using '--no-cache' for 'apk add', not clearing
# '/var/cache/apk/*' results in a larger image
#
# bash, coreutils, jq are required by 'script.sh'
# libc6-compat is required by AzCopy
#
# azure-cli-core, azure-common, azure-mgmt-compute, azure-mgmt-monitor,
# azure-mgmt-resource, semver are required by Azure CLI to
# run all its commands within 'script.sh'
RUN : \
    && apk update \
    && apk add --no-cache --virtual=build cargo gcc libffi-dev linux-headers make musl-dev openssl-dev python3-dev \
    && apk add --no-cache bash coreutils jq libc6-compat \
    && pip install --no-dependencies azure-cli \
    && pip install azure-cli-core \
        azure-common \
        azure-mgmt-compute \
        azure-mgmt-monitor \
        azure-mgmt-resource \
        semver \
    && apk del --purge build \
    && rm -rf /var/cache/apk/* \
    && wget "https://azcopyvnext.azureedge.net/${AZ_COPY_RELEASE}/azcopy_linux_amd64_${AZ_COPY_VERSION}.tar.gz" \
    && mkdir /opt/azcopy \
    && tar -xvzf "azcopy_linux_amd64_${AZ_COPY_VERSION}.tar.gz" -C /opt/azcopy --strip-components 1 \
    && rm -f "azcopy_linux_amd64_${AZ_COPY_VERSION}.tar.gz"

COPY script.sh ./