Container isolation, capabilities, secrets, rootless Docker, image scanning, and security best practices.