[raesene9]

Yep I've always had read only root filesystems down as a good control and one that's often not too tough to implement.

Another favourite of mine would be using multi-stage builds and minimal base images in production (FROM Scratch, where possible). having limited or no tooling in the running container makes an attackers life trickier for sure.

[travisd]

The distroless static images are pretty good. It’s essentially scratch plus certificate authority roots of trust.