Harden containers

[icarito]

A couple of improvements:

• Enable apt-get update && apt-get upgrade for production containers.
• Look into using an unprivileged user for running the application.

While it's common practice to run apps as root in containers, I think it's still a good idea to limit permissions available to it, even in a container.