How to remove /blog/ prefix for custom post types in permalinks?

Extend the 'rewrite' argument to suppress the first URL part:

        'rewrite' => array(
            'with_front' => false,
            'slug'       => 'product'
        )

But using just %postname% for different post types is really tricky and error prone. Avoid it.