Check Dockerfile security instincts around USER, COPY ownership, build secrets, capabilities, and lean final stages.