It turns out that the preferred solution is to use apt (docs https://github.com/GoogleContainerTools/rules_distroless/blob/main/docs/apt.md).
apt