Debian distroless had 5 critical CVEs (unfixed in Debian 12). Alpine has active security patches and smaller footprint.