Complete procedures with a way back.

Introduce per-user keys, validate a drop-in, test a second session, and only then disable password and root login.

Create a default-deny host firewall with loopback, established traffic, controlled SSH, service ports, logging, validation, and rollback.

Install from Docker's signed repository, limit daemon exposure, bound logs, and document privilege boundaries.

Use a dedicated identity, explicit paths, bounded restarts, sandboxing, logs, and a verified rollback.

Create a named administrator, prove key-based recovery access, patch the host, restrict SSH, enable a host firewall, and verify time and exposed services.