The issue in T274310: Building wheels for cryptography package requires rust compiler has reminded me that the base image in use by Toolhub for developing/testing/running the app was chosen because it was the only Debian Buster + Python3 base image that I could find in the Wikimedia registry at the time. I put a # FIXME: we need a non-dev Python3 buster base image comment in the file, but did not create an associated task to keep track of this tech debt.
The basic need is for a container with a Python 3.7 (or newer) runtime. Ideally this image would also include a newer pip package than the one shipped in Debian Buster, but we can probably figure out how to live with the rapidly aging pip 18.1 if there is also a 'dev' variant of the base image which includes the necessary Rust packages to support building cryptography >=3.4.