Why would you even have an SSH server running in a Docker container (unless the purpose of the container is being a jumpbox or similar)?

I can’t emphasise it enough how much more secure you get when you use rootless, read-only containers that are limited to truly just the software you want to run and its dependencies.

Alpine is great for dev containers, but the final container should be:

• immutable on the app layer (any executable path needs to be read only)
• have only the absolutely necessary GNU tooling, service management, etc. included (for most software you don’t even need these tools, and why would you give an attacker who gain access to your container, an easy way to e.g. scan your network?)
• only the data mounted, rw only if absolutely necessary (e.g. if you host a Jellyfin server, just an example, you should have the mounted media be RO, and only the config and caches be writable, mounted noexec of course)