Roche interview question

What are container security best practices?