Docker containers shouldn't run as root

[itamarst]

Hi,

As I discuss here (https://pythonspeed.com/articles/root-capabilities-docker-security/), running Docker containers as root is a problem, opening you up to a bunch of security attacks (e.g. escalation to root on host in February 2019 CVE, which was preventable by starting as non-root user).

Could you update your best practices to note this, and your default Dockerfile to switch to a non-root user? Since your article seems pretty popular, people are no doubt using it as basis for what they build, which is fine—but it would be good if they started with something that was secure by default.

[itamarst]

(fixed link above, sorry)