Your question is Secure Docker Image Build Practices. Take a moment with it on the right.
Talk me through your thinking if you like. When you're confident, submit your answer and I'll grade it like a real screen (7/10 or better passes).
You are setting standards for how your team builds and publishes container images for services that will run in production. You want to make sure image creation is secure from the start so vulnerabilities, leaked secrets, and unsafe base images do not enter the delivery pipeline.
What security best practices do you follow when creating Docker images, especially in a CI/CD workflow, and how do you reduce deployment risk if a bad image still gets promoted?