A distroless base image, and debugging without a shell

An image with no shell, no package manager and no coreutils has a very small attack surface and is genuinely unpleasant the first time something goes wrong inside it.

FROM php:7.3-cli-alpine AS builder
RUN composer install --no-dev

FROM gcr.io/distroless/base
COPY --from=builder /usr/local/bin/php /usr/local/bin/php
COPY --from=builder /app /app
ENTRYPOINT ["/usr/local/bin/php", "/app/worker.php"]

# and when you need to look inside:
# docker run --rm -it --pid=container:worker --net=container:worker 
#   nicolaka/netshoot

The debugging answer is a sidecar sharing the namespaces rather than a shell in the image, which is a better arrangement anyway — the tools are in a separate image that is never deployed. For PHP the win is smaller than for a compiled language, because the runtime and its extensions are most of the image regardless. Worth doing for a worker with a narrow job and not worth the friction for the main application container.