How should non-root containers be designed for production in Container Security?

Create a dedicated UID/GID, set file ownership during build, avoid privileged ports, and enforce runAsNonRoot with policy.