Improved security

Build-generated files only accesible by its owner
System umask set to 0077
removed unneded unsecure kernel mounts (/proc & /sys)
rootfs re-mount as read-only (needs fixing)
filesystems mounts with NODEV & NODUID flags
In Docker, don't bring a shell by default