What does a distroless image remove compared to a minimal distro like Alpine?

Distroless removes the shell, package manager, and most other OS utilities, leaving essentially just the application and its runtime dependencies — Alpine retains a shell (via BusyBox) and a package manager, which is convenient for debugging but expands the attack surface available to anyone who achieves code execution.