Which two actions help limit the attack surface of your Docker container?

Running only a single service in each container and using version tags for base images and dependencies helps limit the attack surface of your Docker container. This ensures that only the necessary services are running and that you always have the latest versions of the base images and their dependencies, reducing the risk of malicious code being included in the container image. Reference: Docker Documentation, Security Best Practices.