I have a Google Alert set up, so I get notified in case my name pops up on the web. A month after I joined a new company, I got an alert - turned out that their internal directory page was exposed to the public web. I was pretty livid - all this time I was proud of maintaining good anonymity, looking up my name never returned anything meaningful on Google. So I complained to my boss about this, and he said it was actually a bug/misconfiguration - which they were already aware of, but didn’t bother fixing it because no one complained. I was super pissed and made it very clear that it was a violation of my privacy and I wanted it taken down ASAP. Thankfully my boss was understanding and got it fixed. Then I had to report the page to Google. It took a while, but it was finally gone from the search results.

I that case, check out Fedora CoreOS.

https://www.talos.dev/

It runs entirely in RAM, administration is super simple, no ssh, easy to update/and upgrade, immutable, minimal distro designed specifically for secure container usage.

How about Gogs? The whole thing is < 30 MB, and is lightweight enough to run on a Raspberry Pi. You can even get a native binary package if you want to run it without the overhead of Docker.