I\'m not a deep expert on docker files but came across this directive in a recent review:
RUN rm /bin/su
which looks like it could create a d