Make backend image rootless

backend/Dockerfile

@@ -1,6 +1,19 @@
 FROM python:3.9-slim-buster as base
+
 WORKDIR /app
 
+# Create a non-privileged user that the app will run under.
+# See https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user
+ARG UID=10001
+RUN adduser \
+    --disabled-password \
+    --gecos "" \
+    --home "/nonexistent" \
+    --shell "/sbin/nologin" \
+    --no-create-home \
+    --uid "${UID}" \
+    appuser
+
 # certificates config
 ARG CACERT_LOCATION
 COPY ./cert/. /etc/ssl/certs/

docker-compose-dev.yml

@@ -11,6 +11,7 @@ services:
       context: ./backend
       target: ${BUILD_TARGET:-dev}
     container_name: basegun-backend
+    user: appuser
     environment:
       - PATH_LOGS=/app/logs
       - OS_USERNAME