3. Don't run processes are root, most of the times you don't have to, it's an easy easy win and protects against many docker security CVEs.
To be fair the official documentation Dockerfile best practices does mention this (although it also gives contradictory advice).
FROM golang:1.12.4
WORKDIR /opt/src/github.com/project1/myprog/
COPY . .
RUN go get -d -v ./...
RUN CGO_ENABLED=0 GOOS=linux go build -a -mod=vendor -o myprog .
FROM ubuntu:latest
RUN useradd -u 5002 user1
FROM scratch
COPY --from=0 /opt/src/github.com/project1/myprog/myprog .
COPY --from=1 /etc/passwd /etc/passwd
USER user1
ENTRYPOINT ["./myprog"]