On launch of the container consider updating the openvpn user password.
This would prevent abuse of this account when the container is exposed to the internet, but assumadly administrators would have the ability to enter the container to obtain the password file in case of lockout.
tr -cd '[:alnum:]' < /dev/urandom | fold -w30 | head -n1>/root/openvpn
random=`cat /root/openvpn`
echo openvpn:$random | /usr/sbin/chpasswd