Incoming container traffic should be bound to a specific host interface

Check containers periodically to see if they are running properly.

The hosts process namespace should not be shared by containers

Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than the designated amount of memory

Attribute 'security_opt' should be defined.

Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessary capabilities as well.