container-security

Container runtime security — non-root users, read-only filesystems, capability dropping, secrets hygiene, image scanning, supply-chain verification, and runtime policy enforcement