Use non-root user inside container.
Make the file system read only.
One process per container.
Don’t restart on failure, crash cleanly instead.
Log to stdout & stdderr
Add dumb-init to prevent zombie…