Containers should not run as root by default