How do you implement Docker security best practices?

Docker security best practices: 1) Use official base images, 2) Keep images updated, 3) Run as non-root user, 4) Use minimal base images (Alpine, distroless), 5) Scan images for vulnerabilities, 6) Implement proper secrets management, 7) Use read-only filesystems, 8) Limit container capabilities. Example secure Dockerfile: FROM node:14-alpine, RUN addgroup -g 1001 -S nodejs, RUN adduser -S nextjs -u 1001, WORKDIR /app, COPY --chown=nextjs:nodejs . ., USER nextjs, EXPOSE 3000, CMD ["node", "server.js"]. Runtime security: docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE app, docker run --read-only --tmpfs /tmp app.