How should Docker images be implemented for production?

Use small trusted base images, multi-stage builds, pinned versions, non-root users, vulnerability scanning, and immutable tags or digests.