1.Application container must not access DB as a root
2.Dedicated user with privileges limited to only those really required should be used
3.Application may initialized DB using root account from a dedicated job container