Docker has apparmor and secco o profiles. Apart from the default, you can monitor for syscalls and build a custom, pet app profile. Couple that with proper mou

Docker has apparmor and secco o profiles. Apart from the default, you can monitor for syscalls and build a custom, pet app profile. Couple that with proper mount perms, drop root user, monitor for outgoing connections and write proper firewall rules (cillium can be used to write bpf rules) and you are pretty secure. You need time, attention to detail and multiple iterations to distill the profiles for each layer.