checks:
  exclude:
  - "no-read-only-root-fs"
  - "run-as-non-root"