Docker Builds and Container Runtime

Keep image-hardening recommendations focused on production images. Disable runtime networking only when the workload needs no network access, including for local development and one-off tasks.

Keep the scope limited to Dockerfile structure, build context, BuildKit behavior, image contents, runtime hardening, and Compose. Delegate CI trust boundaries, permissions, credentials, action references, and cache-backend orchestration to a GitHub Actions-specific skill.