Container security should proactively reduce the attack surface during the image build stage, rather than relying solely on post-deployment scanning and patching.