Comment by atmosx

3. Don't run processes are root, most of the times you don't have to, it's an easy easy win and protects against many docker security CVEs.