Out of the box, a container's process runs as root, nobody checks whether it actually works, and nobody looks for known holes in its packages. Three habits fix all three.