cis-docker rules provide potential for security hardening

### Problem Statement

I'm not an expert in this, but I've been looking at cis-docker rules for improving the security of the sentry deployment, see for example here: https://www.aquasec.com/cloud-native-academy/docker-container/docker-cis-benchmark/

Before I start messing to much with my install, I'm wondering if any of this is interesting for the community, or maybe these are things that have already been considered and rejected?

Some of the suggested changes are to set the security option "no-new-priviliges", which I assume could be applied to most if not all of the containers.

Read-only container filesystems can probably work in a few places too, based on just the fact that many volumes are defined, but might also require some work.

There's further suggestions, but those seem like a good starting point.

### Solution Brainstorm

_No response_