Reduce container privileges with security contexts, Linux capabilities, seccomp, read-only filesystems, and non-root execution. Enforce namespace-level standards with Pod Security Admission.
