Run app as non-root user in Dockerfile for enhanced security

Dockerfile

@@ -23,6 +23,8 @@ RUN --mount=type=cache,target=/root/.cache/uv \
 # ---- Development Stage ----
 FROM python:3.13.3-slim-bookworm AS development
 
+RUN useradd -m -u 1000 appuser
+
 WORKDIR /src
 
 ENV PYTHONUNBUFFERED=1 \
@@ -42,6 +44,14 @@ COPY --from=builder ${VIRTUAL_ENV} ${VIRTUAL_ENV}
 # Copy application code
 COPY . /src
 
+# Ensure permissions so non-root can read/execute env and write to repo dirs if needed
+RUN chown -R appuser:appuser /virtualenvs /src
+
+# Streamlit config: use the non-root user's home and disable telemetry writes
+ENV HOME=/home/appuser
+
+USER appuser
+
 EXPOSE 8501
 HEALTHCHECK CMD curl --fail http://localhost:8501/_stcore/health || exit 1