Containerized microservices for a 311 intake API should avoid running as root and should use tight filesystem permissions inside the image. Which hardening choice aligns with that goal?
Select an answer to reveal the explanation.
Short Explanation
A container that runs as root with wide-open files is a gift box for anyone who breaks in. Drop privileges, tighten permissions, and keep the host socket out of the app container. Unprivileged users are the default you want for city microservices.
Full Explanation
Container security best practice prefers unprivileged users and restrictive filesystem permissions to limit impact if a process is compromised. Privileged root, host Docker socket mounts, and broad capabilities such as CAP_SYS_ADMIN dramatically increase host and cluster risk. Cloud+ security objectives include container hardening choices for cloud-native workloads.