Don't make this container security mistake: running as root