The 19 MB difference is alpine linux crud, musl and other base things in my custom docker base image.

In theory I could do the multi-stage docker approach to get an as-tiny-as-possible setup (and I actually do this: https://github.com/Xe/site/blob/master/Dockerfile) but that won't cover ca-certificates generically.