Fun in the RUN instruction: Why container builds with distroless images can surprise you

When using distroless container images (like Red Hat Hardened Images), the RUN instruction in a Containerfile fails because distroless images have no shell (/bin/sh). By default, RUN executes commands via /bin/sh -c, which doesn't exist in distroless images. The fix is to use the exec format for RUN — the same bracketed array syntax used in CMD and ENTRYPOINT — to call binaries directly without a shell intermediary. For example, RUN ["/usr/bin/pip", "install", "flask"] works where RUN pip install flask does not.