break su for everybody but root

This is probably not necessary, but it provides belt-and-suspenders.
It also provides immediate fail to anybody inside the app container.

    user@wormhole:~$ su -
    su: Authentication failure