docker run --read-only --tmpfs /tmp myapp

Mounts the container's root filesystem read-only so nothing can write outside declared mounts. The tmpfs /tmp gives processes a scratch area that disappears on exit. Strong hardening for untrusted workloads.