A hardened container image, point by point
Non-root user, read-only filesystem, SBOM, signature: what each measure really prevents, in what order to apply them, and what they do not replace.
Category
Security
Prompt injection: the flaw agents have to learn to live with
A model does not firmly tell an instruction from a piece of data: it is all text. As long as that holds, an agent reading outside content can be hijacked. You cannot remove the flaw, you can bound what it can cause.