- document root is owned by root and not writable by www-data
(the base image ships /var/www/html as www-data with mode 1777)
- uses php.ini-production, so errors are not shown to clients
- disables directory listings, expose_php and the detailed server signature
