Nothing turned off and no special hardening over a default php setup within the container, some hardening on the host machine to reduce the risk of some zero day against the OS scuttling the competition. Added a /ping endpoint to validate.

If you can get the php process to run the `print-flag` binary you will get the flag.

curl -X POST -d 'message=ping' https://stealmybitcoin.com/ping.php