How do you implement container security best practices?

Container security spans the entire lifecycle: build, registry, runtime, and orchestration. Build: use minimal base images (distroless, Alpine, or scratch for Go binaries) to reduce attack surface, implement multi-stage builds (build dependencies don't appear in final image), run as non-root user (USER directive in Dockerfile), don't store secrets in images (use runtime injection), and pin base image versions (avoid using latest tag). Scanning: scan images for vulnerabilities during CI (Trivy, Snyk, Grype), implement admission controllers that reject unscanned or vulnerable images, and scan registry images on a scheduled basis for newly discovered CVEs. Registry: use private registries (ECR, GCR, ACR, or Harbor), implement image signing (cosign, Notary) for supply chain integrity, implement RBAC on registry access, and maintain an allowlist of approved base images. Runtime: implement read-only root filesystem, drop all Linux capabilities and add only required ones, implement seccomp profiles to restrict system calls, use AppArmor or SELinux for mandatory access control, and limit container resources (CPU, memory, PIDs). Kubernetes security: implement Pod Security Standards (restricted profile), use Network Policies to restrict pod communication, implement OPA Gatekeeper for policy enforcement (no privileged containers, required resource limits, required labels), and use Kubernetes RBAC for API access control. Secrets management: use external secrets operator to inject secrets from Vault, AWS Secrets Manager, or Azure Key Vault at runtime rather than baking into images or environment variables. Monitoring: implement runtime threat detection (Falco for abnormal container behavior), log all container lifecycle events, and alert on privilege escalation attempts or unusual network connections. Supply chain: maintain SBOM (Software Bill of Materials) for all images, verify image provenance using SLSA framework, and implement build attestations.