Security: Docker container runs as root — no non-root USER defined in Dockerfile