Docker Hardening

Covers the stuff that actually bites you: unprivileged users, read-only filesystems, capability dropping, seccomp profiles, network isolation. The multi-stage build patterns for minimizing attack surface are solid, and the section on secret handling (build args vs runtime env vs mounted secrets) is exactly right. I've audited containers that looked fine on the surface but failed on half of this checklist. Now I run this against every Dockerfile before it goes to prod. Worth it for the network segmentation patterns alone.