Secure container images and runtime environments