What's the practical difference between choosing Alpine vs distroless for a production image?

Alpine generally produces the smallest raw image size and retains a shell and package manager (busybox-provided), which is convenient for interactive debugging but means more available tooling if an attacker gains code execution. Distroless removes the shell and package manager entirely, slightly increasing size relative to a minimal Alpine image in some cases but meaningfully reducing the post-compromise attack surface, at the cost of needing a separate debug-variant image (most distroless families publish a debug tag) for any interactive troubleshooting.