we gave up on minimal images for this exact reason. the cuda/torch dependencies are just too massive to strip down effectively. in our case we rely on gVisor for isolation instead. with ~10k pods we treat the container as untrusted and enforce security at the runtime level via runsc.