Why security in cloud-native workloads starts at the container level