This tool is great! Ran through all these checks and deployed them to our cluster the other day.

Immutable fs & non-root is easier than I thought to deploy with k8s, going to be looking into privilege drops this week too.