Container Security: Running as Non-Root

By default, Docker containers run as `root`. If a container breakout vulnerability exists, the attacker gains root access to the host.

The Fix

Create a dedicated user in your Dockerfile.

FROM mcr.microsoft.com/dotnet/aspnet:5.0
WORKDIR /app
COPY . .

# Create user
RUN adduser --disabled-password --gecos "" appuser
USER appuser

ENTRYPOINT ["dotnet", "MyApp.dll"]

Enforce this in Kubernetes using `securityContext`: `runAsNonRoot: true`.