instruction: Create a comprehensive Dockerfile for cluster applications with best practices
output: ```dockerfile
  from other containers, and abusing the credentials of system services, such as Kubelet.You should only allow access to create PersistentVolume objects for:Users (cluster operators) that need this access for their work, and who you trust.The Kubernetes control plane components which creates PersistentVolumes based on PersistentVolumeClaims
  that are configured for automatic provisioning.
  This is usually setup by the Kubernetes provider or by the operator when installing a CSI driver.Where access to persistent storage is required trusted administrators should create
  PersistentVolumes, and constrained users should use PersistentVolumeClaims to access that storage.Access to proxy subresource of NodesUsers with access to the proxy sub-resource of node objects have rights to the Kubelet API,
  which allows for command execution on every pod on the node(s) to which they have rights.
  This access bypasses audit logging and admission control, so care should be taken before
  granting rights to this resource.Escalate verbGenerally, the RBAC system prevents users
  ```