Reproduce the error with a non-root container, read the owner numbers and fix it by changing the folder's owner or the container's user. After this, you can tell which side to change and stop reaching for chmod 777.
Pass variables from your shell, from an env file and from a Compose secret, and make Compose refuse to start when a required one is missing. After this, you can keep real values out of your files and your commands.
Add a user to an image, give it only the folder it writes to, and fix the two permission errors you will most likely hit. After this, your containers stop running as root.
Look up a base image digest, pin it in the FROM line, check the build used it and plan how to update it. After this, your builds are repeatable without missing security fixes.
Log in to a password-protected registry the way a CI job should, push an image, log out, and see the GitHub Actions version. After this, CI logins stop leaking tokens.
Find where an app writes, run it read-only, and give it a tmpfs for scratch files and a volume for data. After this, nothing inside the container can change its own files.
Export an SPDX SBOM from a real build, list its packages and scan it with Grype, without a Docker account. After this, you can hand over what is in an image and what was known about it on a given day.