(Evan Peters has been working as a DevSecOps engineer in an IT company located in Denver, Colorado. His organization has deployed various…

Running an SSH daemon inside every container is a security anti-pattern. It unnecessarily increases the container's attack surface and complicates credential management. The best practice is to run the SSH service on the host machine and use the docker exec command to gain interactive shell access to a running container (e.g., docker exec -it /bin/sh). This approach centralizes access control, logging, and security hardening on the host, leveraging its mature security mechanisms rather than introducing a potential vulnerability into each container.

A: A Docker registry is a storage system for Docker images; it does not run containers or SSH services.

B: docker build is the process of creating an image from a Dockerfile and is not a runtime environment.

C: The SSH service is a server-side daemon that must run on the machine hosting the containers, not the client.

Docker Inc. (2019, September 19). "Docker security." Docker Documentation. Section: "Container security". Retrieved from https://docs.docker.com/engine/security/. (This documentation advises on minimizing the attack surface within containers).

Badger, L., Grance, T., Patt-Corner, R., & Voas, J. (2017). NIST Special Publication 800-190: Application Container Security Guide. National Institute of Standards and Technology. Section 4.4.2, "Disabling Unnecessary Services in Containers". (This guide recommends minimizing the number of services running inside a container).