Add docs for the hardened Octopus Server Linux Container - #3490

Background

Adds documentation for the hardened Octopus Server Linux Container being built in OctopusDeploy/OctopusDeploy#47150.

Fixes SI-217

Changes

• New page installation/octopus-server-linux-container/hardened-image.md covering:
  • What the hardened image is and who it's for
  • Security update expectations: we pick up OpenSSL/base image changes, even when they break older Tentacles, SSH targets, or clients (the main ask in SI-217)
  • Standard vs hardened comparison
  • Running as a non-root or arbitrary UID (Docker, Kubernetes, OpenShift), volume permissions, and a read-only root filesystem
  • Environment variables, ports, and volumes
  • The container-healthcheck command and Kubernetes probe examples
  • Unsupported features: built-in worker, Script Console on the server, execution containers on the built-in worker, Let's Encrypt
  • Switching between the standard and hardened images, upgrading, and troubleshooting without a shell
• Links the new page from the Linux container index page
• Adds SGID to the spelling dictionary

Open questions before publishing

• Confirm the public image tag (<version>-hardened is a placeholder), and whether there's a latest-hardened
• Confirm a read-only root filesystem is supported
• Confirm Kubernetes fsGroup: 0 / OpenShift restricted SCC guidance
• Confirm the built-in worker stays off after switching back to the standard image
• Check the descriptions for the /etc/octopus and /Octopus/.octopus/OctopusServer/Server volumes
• Decide whether we need a release version or early access callout

🤖 Generated with Claude Code