A hardened container image, point by pointNon-root user, read-only filesystem, SBOM, signature: what each measure really prevents, in what order to apply them, and what they do not replace.October 28, 2026