Migrating Python Services to Docker Hardened Images: What Breaks and How to Fix It

Switching a Python service from a standard Docker image to a Docker Hardened Image (DHI) can break builds due to missing package managers, shell tools, and root permissions. DHI images are minimal, dropping from ~412 MB to ~35 MB and removing most packages to reduce attack surface. The migration requires adapting Dockerfiles to a distroless architecture, often driven by compliance needs for SBOMs and CVE reduction.