How would you answer an interview scenario involving non-root containers in Container Security?

For an interview scenario involving non-root containers, I would first clarify the business goal, scale, constraints, and the failure or quality attribute the interviewer wants to explore. Running as a non-root user limits what a compromised process can do inside a container and on mounted resources. In this scenario, an application only works as root because it writes to /app. Explain the safer fix. For production, create a dedicated UID/GID, set file ownership during build, avoid privileged ports, and enforce runAsNonRoot with policy. I would then explain the main alternatives and tradeoffs, identify likely failure modes, and describe how I would validate the solution through testing, observability, security controls, and recovery or rollback planning.