Most production Docker images are bloated. Use multi-stage builds and start from minimal base images to reduce image size.
By default, Docker containers run as root. Add a non-root user inside your image and avoid mounting the Docker socket unless necessary.
If your .dockerignore is missing or incomplete, Docker might be copying your entire repo into the image. Use .dockerignore like your .gitignore to avoid unnecessary copying.
In production, improper volume usage can break statelessness, create permission issues, and introduce state inconsistency between replicas. Only mount named volumes with a clear purpose and make volumes read-only where possible.