This will never be able to satisfy all needs with just one image (esp. without the image becoming too large). There are many more pandoc filters that will be potentially used, even in combination. It seems, a better approach would be to keep the main pandoc image minimal and redirect the calls to secondary applications within filters to a separate container. This could be accomplished by providing

• a simple "proxy" executable for each external application in the main image and
• images for each application that accepts REST requests to run this application.

Update A simpler alternative would be to repeatedly use pandoc to produce standalone native, each time just applying the available filter. The "main" image then converts it to pdf.