How should Docker security be implemented for production?

Run as non-root, drop unnecessary capabilities, use read-only filesystems when possible, scan and sign images, protect the daemon, and patch base images regularly.