Containers are easy to start and easy to run badly. Production hardening is mostly boring discipline.
Resource and probes
Set CPU/memory limits, readiness/liveness probes, and graceful shutdown. Missing probes cause cascading restarts.
Secrets and config
Keep secrets out of images. Prefer mounted secrets and short-lived credentials.
Network policy
Default-deny where possible. Most breaches expand laterally through over-permissive cluster networking.