如何使用Nix构建体积最小的Python Docker镜像？

我目前能做到的最小镜像体积为133MB，但官方Python slim镜像仅约40MB，因此我认为还可以优化。以下是我的尝试方案：

buildImage: 133MB #

{ pkgs ? import ./pinned.nix { }
, pkgsLinux ? import ./pinned.nix { system = "x86_64-linux"; }
}:

pkgs.dockerTools.buildImage {
  name = "python-docker";
  tag = "latest";
  config = {
    Cmd = [ "${pkgsLinux.python3}/bin/python" "--version" ];
  };
}

buildImage + copyToRoot: 219MB #

{ pkgs ? import ./pinned.nix { }
, pkgsLinux ? import ./pinned.nix { system = "x86_64-linux"; }
}:

pkgs.dockerTools.buildImage {
  name = "python-docker";
  tag = "latest";
  copyToRoot = [ pkgsLinux.python3 ];
  config = {
    Cmd = [ "python3" "--version" ];
  };
}

buildImage + contents: 219MB #

{ pkgs ? import ./pinned.nix { }
, pkgsLinux ? import ./pinned.nix { system = "x86_64-linux"; }
}:

pkgs.dockerTools.buildImage {
  name = "python-docker";
  tag = "latest";
  contents = [ pkgsLinux.python3 ]; # 会显示警告，因为`contents`已被弃用
  config = {
    Cmd = [ "python3" "--version" ];
  };
}

buildLayeredImage: 133MB #

{ pkgs ? import ./pinned.nix { }
, pkgsLinux ? import ./pinned.nix { system = "x86_64-linux"; }
}:

pkgs.dockerTools.buildLayeredImage {
  name = "python-docker";
  tag = "latest";
  config = {
    Cmd = [ "${pkgsLinux.python3}/bin/python" "--version" ];
  };
}

buildLayeredImage + copyToRoot: 无法正常工作 #

{ pkgs ? import ./pinned.nix { }
, pkgsLinux ? import ./pinned.nix { system = "x86_64-linux"; }
}:

pkgs.dockerTools.buildLayeredImage {
  name = "python-docker";
  tag = "latest";
  copyToRoot = [ pkgsLinux.python3 ];
  config = {
    Cmd = [ "python3" "--version" ];
  };
}

buildLayeredImage + contents: 134MB #

{ pkgs ? import ./pinned.nix { }
, pkgsLinux ? import ./pinned.nix { system = "x86_64-linux"; }
}:

pkgs.dockerTools.buildLayeredImage {
  name = "python-docker";
  tag = "latest";
  contents = [ pkgsLinux.python3 ];
  config = {
    Cmd = [ "python3" "--version" ];
  };
}

pinned.nix 内容 #

import (
  builtins.fetchTarball {
    url = "https://github.com/NixOS/nixpkgs/archive/1c6eb4876f71e8903ae9f73e6adf45fdbebc0292.tar.gz";
    sha256 = "15gc5vmpz0wpasra6xmqq2l4cc65g9jm1zfrm16w43hmanrzx3l4";
  }
)

注意：我使用的是Mac M1笔记本电脑。

内容的提问来源于Stack Exchange，提问作者swoutch