How should minimal container images be designed for production in Container Security?

Use multi-stage builds, minimal trusted bases, pinned versions, and retain only required runtime files.