We split our pex_binaries into one with the 3rd party deps and one with the sources, then we combine them in the docker image. I assume that if we want to be able to

pants run

them, we need to make a 3rd, that has everything and we just use that as the target for run and nothing else?

You could run the docker image itself if the command is running your pex. Or if it's running something else you could add an intermediate docker stage that would run the pex and run that