security(ini): auditing legacy runtime flags in container base images 🛡️
Hardening base Dockerfiles by explicitly turning off legacy serialization toggles (
session.upload_progress.enabled = Off) and disallowing runtime handler switches neutralizes entire classes of deserialization RCEs before CVE patches even land. What's your standard baseline checklist of hardened runtime defaults when building production images?commit 3466e2b