Production containers do not expose SSH port 22 or RDP

SSH port 22 exposed in a production container provides a persistent shell entry point for brute-force and credential-stuffing attacks — every host scanner on the public internet probes port 22 continuously (CWE-284, NIST 800-53 CM-7). A container with sshd installed adds unnecessary attack surface: the application has no need for interactive sessions, and any credential compromise or key leak provides direct OS access bypassing all application-layer controls. CIS Docker 5.6 explicitly prohibits SSH in containers. Kubernetes provides kubectl exec as the authenticated, audited alternative for debugging.

Remove all SSH-related packages and EXPOSE directives from production Dockerfiles. Audit with:

grep -r 'EXPOSE 22\|openssh\|sshd\|ssh-server' Dockerfile*

For debugging and interactive access use kubectl exec with RBAC controls:

# Requires 'pods/exec' verb in RBAC — scope to specific service accounts
kubectl exec -it <pod-name> -n production -- /bin/sh

If jump-host access to nodes is required, use AWS SSM Session Manager, GCP IAP tunneling, or Azure Bastion — these route through cloud IAM and produce audit logs without opening port 22. Remove the openssh-server package from base images: RUN apt-get remove --purge openssh-server.