diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..e5b9c47
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,10 @@
+.git
+.github
+test
+Makefile
+README.md
+LICENSE
+.dockerignore
+**/__pycache__
+**/*.pyc
+.DS_Store
diff --git a/Dockerfile b/Dockerfile
index 4f02ef3..4678267 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,6 +3,29 @@
 # Extended from github.com/jupyter/docker-stacks
 # See also http://blog.dscpl.com.au/2016/01/roundup-of-docker-issues-when-hosting.html
 
+# Build the nss_wrapper separately
+FROM python:3.13-slim-bullseye AS nss-builder
+
+ENV DEBIAN_FRONTEND noninteractive
+ENV NSS_WRAPPER_VERSION 1.1.2
+
+RUN apt-get update && apt-get install -yq --no-install-recommends \
+    build-essential \
+    ca-certificates \
+    cmake \
+    wget \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN wget -q https://ftp.samba.org/pub/cwrap/nss_wrapper-${NSS_WRAPPER_VERSION}.tar.gz && \
+    mkdir nss_wrapper && \
+    tar -xC nss_wrapper --strip-components=1 -f nss_wrapper-${NSS_WRAPPER_VERSION}.tar.gz && \
+    mkdir nss_wrapper/obj && \
+    (cd nss_wrapper/obj && \
+    cmake -DCMAKE_INSTALL_PREFIX=/usr/local -DLIB_SUFFIX=64 .. && \
+    make && \
+    make install)
+
+
 FROM python:3.13-slim-bullseye
 
 LABEL maintainer="Nick Greenfield <nick@onecodex.com>"
@@ -13,28 +36,20 @@ USER root
 # features (e.g., download as all possible file formats)
 ENV DEBIAN_FRONTEND noninteractive
 RUN apt-get update && apt-get install -yq --no-install-recommends \
-    apt-transport-https \
-    build-essential \
     bzip2 \
     ca-certificates \
-    cmake \
     curl \
+    fontconfig \
     fonts-dejavu \
-    gcc \
-    gfortran \
-    git \
-    gnupg \
     locales \
-    python-dev \
+    patch \
+    procps \
     libffi7 \
     libpango-1.0-0 \
     libpangoft2-1.0-0 \
     libcairo2 \
-    sudo \
     unzip \
-    vim \
-    wget \
-    fonts-texgyre \
+    xz-utils \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
@@ -47,6 +62,8 @@ ADD https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini /usr/
 RUN chmod +x /usr/local/bin/tini \
     && echo "12d20136605531b09a2c2dac02ccee85e1b874eb322ef6baf7561cd93f93c855 /usr/local/bin/tini" | sha256sum -c -
 
+COPY --from=nss-builder /usr/local/lib64/libnss_wrapper.so /usr/local/lib64/
+
 # Configure environment
 ENV SHELL /bin/bash
 ENV NB_USER jovyan
@@ -69,8 +86,12 @@ RUN mkdir /home/$NB_USER/work && \
 
 
 ADD requirements.txt /root/
-RUN pip install -U pip && \
-    pip install -q -r /root/requirements.txt
+# Install Python packages, allow full access for the NB_USER
+# chown has to be run in the same command otherwise the files are copied in the next docker layer
+RUN pip install --no-cache-dir -U pip && \
+    pip install --no-cache-dir -q -r /root/requirements.txt && \
+    rm -rf /usr/local/lib/python3.13/site-packages/biom/tests && \
+    chown -R $NB_USER:root /usr/local/lib/python3.13
 
 # Activate ipywidgets extension in the environment that runs the notebook server
 RUN jupyter nbextension enable --py widgetsnbextension
@@ -79,18 +100,6 @@ RUN jupyter contrib nbextension install --user && \
 
 WORKDIR /home/$NB_USER/work
 
-# Install nss_wrapper
-RUN wget https://ftp.samba.org/pub/cwrap/nss_wrapper-1.1.2.tar.gz && \
-    mkdir nss_wrapper && \
-    tar -xC nss_wrapper --strip-components=1 -f nss_wrapper-1.1.2.tar.gz && \
-    rm nss_wrapper-1.1.2.tar.gz && \
-    mkdir nss_wrapper/obj && \
-    (cd nss_wrapper/obj && \
-    cmake -DCMAKE_INSTALL_PREFIX=/usr/local -DLIB_SUFFIX=64 .. && \
-    make && \
-    make install) && \
-    rm -rf nss_wrapper
-
 # Copy `onecodex` installed fonts to local directory
 RUN cp /usr/local/lib/python3.13/site-packages/onecodex/assets/fonts/*.otf /usr/local/share/fonts && fc-cache
 
@@ -120,7 +129,8 @@ RUN chmod +x /usr/local/bin/token_notebook.py
 # Add patch to jupyter notebook for export to One Codex document portal
 COPY notebook/notebook.patch /usr/local/lib/python3.13/site-packages/notebook
 RUN cd /usr/local/lib/python3.13/site-packages/notebook \
-    && patch -p0 < notebook.patch
+    && patch -p0 < notebook.patch \
+    && chown -R $NB_USER:root /usr/local/lib/python3.13/site-packages/notebook
 
 # Finally fix permissions on everything
 # See https://github.com/jupyter/docker-stacks/issues/188
@@ -129,8 +139,5 @@ RUN chown -R $NB_USER:root /home/$NB_USER && find /home/$NB_USER -type d -exec c
 
 ENV PYTHONPATH "/home/jovyan/.local/lib/python3.13"
 
-# Provide full access to the Python directory to allow for pip installs
-RUN chown -R $NB_USER:root /usr/local/lib/python3.13
-
 # Switch to unprivileged user, jovyan
 USER $NB_USER
diff --git a/requirements.txt b/requirements.txt
index 4c24d21..af6c47d 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,7 +1,6 @@
 # jupyter_contrib_nbextensions imports pkg_resources, which setuptools removed
 # in v81; the python:3.13-slim base image no longer ships setuptools at all.
 setuptools<81
-awscli
 biopython
 ipywidgets
 jupyter_contrib_nbextensions