Run the Container as a Non-Root User

Labs have no container engine, so nothing is built or started: your files are checked by reading them, the way a reviewer or a CI linter would. docker-compose config (to validate Compose files) and hadolint (a Dockerfile linter) are installed.

A security scan flagged the image of /home/student/projects/mailer: the Python app runs as root.

Task

Change the Dockerfile so that:

• it creates a system user app (and group app) with UID 10001
• /app and everything copied into it belong to that user
• the container runs as that user: the last USER before the start command is app or 10001
• nothing after that switches back to root
• hadolint no longer reports DL3002 (last user should not be root)