Don't run as root; add log rotation; use thin