Check practical container security choices: capabilities, seccomp, read-only filesystems, user IDs, and runtime guardrails.