You might as well drop privileges and tell the kernel to disallow any future privileges even with sudo/su or vulnerabilities.

You can do this by using oneway in your docker entry point

https://github.com/muayyad-alsadi/oneway/blob/master/README....