Shipping companies like to track their cargoes
Obviously, no shipping company wants to be held responsible for letting a container filled with bombs in to the country. The primary and first line of defense against such a container entering the country is the shipping companies themselves.
International logistics are complicated. Cargo ships from the big companies generally run 'rings' around the world; for example, they might go eastward from the Mediterranean through the Suez, stopping in the Middle East and India a few times, then through the Straits of Malacca. After a few stops in the Far East, they cross the Pacific, hit the US West coast, and then the Panama Canal. After the US East coast, they would then cross the Atlantic, do the Strait of Gibraltar, and continue around the world again.
The shipping company will plan for containers of stuff to meet the ship at its ports. If you have some non-time sensitive stuff to ship from Chicago to Beijing, the goods would go by truck or train to a busy US east coast port like New York, Norfolk, Savannah, or Jacksonville, then get loaded on to the ship, sail eastwards around the world to China, then offload at Tianjin or Shanghai and train the rest of the way to Beijing.
Given the complications of massive international inventories, cargo ship's inventories are run by computers, and by people who are paid to know what is on the ships and where it is going.
Specific ways shipping companies will detect terrorist cargoes
First off, lets understand that shipping cargo carriers are done by big business. The largest carriers in the world are almost 1000 times larger than the 100th largest. The top 10 carriers have 71% market share, and the top 30 about 90%. And this is worldwide carriers; the US is even more dominated by the largest carriers (who can afford to the trans-Atlantic and trans-Pacific routes, smaller carriers tend to do regional routes like West Africa or Indian Ocean).
While your friend says that "a very small percentage get inspected," he may be correct only regarding official government agents. Shipping companies and merchant mariners need to know what is in their containers to they can properly store and stack them. Weight in particular is a great concern. A dead giveaway for a falsely registered container would be improper weight.
In addition to the ship operator's natural interest in knowing about the contents of a container, because modern companies are large multi-modal carriers, they usually have a good bit of knowledge about the provenance of the containers. Most shipping companies will vet their business relationships with land carriers (by rail or truck) to ensure that they will only be carrying legitimate business. Since the systems of most of these carriers are also automated, the ability to ensure the origin and contents of cargo is much higher than it was 20 years ago.
Lastly, big shipping companies simply won't take the risk of doing business with pariah countries. Apart from terrorism, no shipping company wants to be censured, fined, or criminally prosecuted for violating customs or sanctions. Given the sanctions against groups like ISIS (and also Iran, and others), shipping companies can't afford to let in containers that originate in those territories.
It would be very hard for terrorist to get a bomb onto a container onto a ship that was headed for the US. Shipping companies just aren't going to Latakia to pick up cargoes these days, and the the small regional carriers that do tend not to do much business with the United States because of the distances involved.
Even if terrorists could get a container through a smaller carrier to a big port like Jebel Ali or Istanbul, shipping companies simply wouldn't take a container of unknown provenance sight unseen at pier side. They would inspect the contents first then seal it and a load it.
The only likely way to get a bomb into the US is to completely disguise it as a non-bomb object. That, however, sounds more like the plot of a Bond movie than something ISIS is capable of.