The latest author of wkhtmltopdf has made the github repository public archive on January 2, 2023, and is recommending not to use it with untrusted HTML.

The best alternative I found is using the chromium headless feature, that has worked quite well for me.

First, install it with the no-recommends option:

apt install chromium --no-install-recommends --no-install-suggests

Then call it with headless mode with below:

chromium --headless --disable-gpu --print-to-pdf-no-header --print-to-pdf=output.pdf https://google.com

Installing this dependency added about 400mb of files, and didn’t add any permanent daemon, and so it remains well contained.