Beyond the build: Why runtime security is critical for container protection