Dockerfile runtime stage runs as root — output files on host owned by root

[coderabbitai]

Problem

The runtime stage of the Dockerfile (if present) never drops root privileges. Files written to bind-mounted data paths end up owned by root on the host, which is both a security concern and a practical inconvenience for developers.

Suggested fix

Add a dedicated non-root system user in the runtime stage, chown the application and data directories to that user, and add a USER directive before ENTRYPOINT:

RUN groupadd --system appuser \
    && useradd --system --create-home --gid appuser appuser

# (after all COPY/mkdir steps)
RUN chown -R appuser:appuser /app /data

USER appuser
ENTRYPOINT ["/app/entrypoint.sh"]

References

• Same issue identified in the WaterFlow repo: Creating a Dockerfile WaterFlow#69 (comment)
• Requested by @marcuscollins

[k-chrispens]

Closing as duplicate of #136