I guess no one knows how to harden an OS anymore so we just put everything in a container someone else made and hope for the best.