**Value:** 4/10 | **Phase:** 3\n\nFor servers running Docker: disable TCP socket, enable user namespaces, set `no-new-privileges`, configure seccomp and AppArmor profiles.