A hardened image is just removing everything that’s not your code, or required for your code to run

From scratch is ideal, distroless is great too

Then use firewalls around your containers as needed