+ use more secure `command` instead of `shell` + read-only command doesn't change state - make idempotent + multi-line long string
