Don't run as root, use immutable images (or make files read-only if the whole image can't be immutable), multi-stage Dockerfiles that use alpine images and don't include build tools, single responsibility images, layer optimization (order instructions from least to most changing), HEALTHCHECK instructions, pin versions explicitly, get dependencies from other images instead of the internet, rebuild frequently, automated upgrade PRs.