A real-world Next.js RCE attack hit production — and failed. This post shows real logs, attacker payloads, and how slim containers, non-root Docker images, minimal env injection, and Cloudflare (free plan) stopped the exploit chain.