Check Dockerfile choices that reduce image size, avoid leaked secrets, and separate build tools from runtime containers.