Chapter 12, Docker Security

1. You would add the --read-only flag; or, if you want to make a volume read-only, you would add :ro
2. In an ideal world, you would only be running a single process per container
3. By running the Docker Bench Security application
4. The socket file for Docker, which can be found at /var/run/docker.sock; and also, if your host system is running Systemd, /usr/lib/systemd
5. False; Quay scans both public and private images