instruction: Create a comprehensive Dockerfile for cluster applications with best practices
output: ```dockerfile
  from users who are members of that group are never sent to the webhook)
  
  Minimize distribution of privileged tokens
  Ideally, pods shouldn't be assigned service accounts that have been granted powerful permissions
  (for example, any of the rights listed under privilege escalation risks).
  In cases where a workload requires powerful permissions, consider the following practices:
  
  Limit the number of nodes running powerful pods. Ensure that any DaemonSets you run
  are necessary and are run with least privilege to limit the blast radius of container escapes.
  Avoid running powerful pods alongside untrusted or publicly-exposed ones. Consider using
  Taints and Toleration,
  NodeAffinity, or
  PodAntiAffinity
  to ensure pods don't run alongside untrusted or less-trusted Pods. Pay special attention to
  situations where less-trustworthy Pods are not meeting the Restricted Pod Security Standard.
  
  Hardening
  Kubernetes defaults to providing access which may not be required in every cluster. Reviewing
  the RBAC rights provided by default can provide opportunities for security hardening.
  In general, changes should not be made to rights provided to system: accounts some options
  to harden cluster rights exist:
  
  Review bindings for the system:unauthenticated group and remove them where possible, as this gives
  access to anyone who can contact the API server at a network level.
  Avoid the default auto-mounting of service account tokens by setting
  automountServiceAccountToken: false. For more details, see
  using default service account token.
  Setting this value for a Pod will overwrite the service account setting, workloads
  which require service account tokens can still mount them.
  
  Periodic review
  It is vital to periodically review the Kubernetes RBAC settings for redundant entries and
  possible privilege escalations.
  If an attacker is able to create a user account with the same name as a deleted user,
  they can automatically inherit all the rights of the deleted user, especially the
  rights assigned to that user.
  Kubernetes RBAC - privilege escalation risks
  Within Kubernetes RBAC there are a number of privileges which, if granted, can allow a user or a service account
  to escalate their privileges in the cluster or affect systems outside the cluster.
  This section is intended to provide visibility of the areas where cluster operators
  should take care, to ensure that they do not inadvertently allow for more access to clusters than intended.
  Listing secrets
  It is generally clear that allowing get access on Secrets will allow a user to read their contents.
  It is also important to note that list and watch access also effectively allow for users to reveal the Secret contents.
  For example, when a List response is returned (for example, via kubectl get secrets -A -o yaml), the response
  includes the contents of all Secrets.
  Workload creation
  Permission to create workloads (either Pods, or
  workload resources that manage Pods) in a namespace
  implicitly grants access to many other resources in that namespace, such as Secrets, ConfigMaps, and
  PersistentVolumes that can be mounted in Pods. Additionally, since Pods can run as any
  ServiceAccount, granting permission
  to create workloads also implicitly grants the API access levels of any service account in that
  namespace.
  Users who can run privileged Pods can use that access to gain node access and potentially to
  further elevate their privileges. Where you do not fully trust a user or other principal
  with the ability to create suitably secure and isolated Pods, you should enforce either the
  Baseline or Restricted Pod Security Standard.
  You can use Pod Security admission
  or other (third party) mechanisms to implement that enforcement.
  For these reasons, namespaces should be used to separate resources requiring different levels of
  trust or tenancy. It is still considered best practice to follow least privilege
  principles and assign the minimum set of permissions, but boundaries within a namespace should be
  considered weak.
  Persistent volume creation
  If someone - or some application - is allowed to create arbitrary PersistentVolumes, that access
  includes the creation of hostPath volumes, which then means that a Pod would get access
  to the underlying host filesystem(s) on the associated node. Granting that ability is a security risk.
  There are many ways a container with unrestricted access to the host filesystem can escalate privileges, including
  reading data
  ```