How should non-root containers be designed for production in Container Security?

A production-ready approach is to create a dedicated UID/GID, set file ownership during build, avoid privileged ports, and enforce runAsNonRoot with policy.