use non-root user

Dockerfile

@@ -1,5 +1,4 @@
 FROM debian:stable-slim AS base
-ENV HOME=/root
 
 ARG GITHUB_BUILD=false \
     VERSION
@@ -10,12 +9,16 @@ ENV GITHUB_BUILD=${GITHUB_BUILD}\
     PYTHONUNBUFFERED=1 \
     # prevents python creating .pyc files
     PYTHONDONTWRITEBYTECODE=1 \
-    UV_LINK_MODE=copy
+    UV_LINK_MODE=copy \
+    UV_CACHE_DIR=/var/cache/uv
 
 WORKDIR /app
 
 RUN apt update && apt -y upgrade && apt install -y curl
 
+# Create non-root user
+RUN groupadd -r appuser && useradd -r -g appuser -u 1000 appuser
+
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
 RUN uvx playwright install-deps firefox && uvx camoufox fetch
 
@@ -26,15 +29,17 @@ ENTRYPOINT [ "sleep", "infinity" ]
 
 FROM base AS app
 COPY pyproject.toml uv.lock ./
-RUN --mount=type=cache,target=${HOME}/.cache/uv uv sync
+RUN --mount=type=cache,target=/var/cache/uv uv sync
 
 COPY . .
+RUN chown -R appuser:appuser /app
 
 FROM app AS test
-RUN --mount=type=cache,target=${HOME}/.cache/uv uv sync --group test
-RUN uv run pytest --retries 3 -n auto
+RUN --mount=type=cache,target=/var/cache/uv uv sync --group test
+RUN uv run pytest --retries 3
 
 FROM app
+USER appuser
 EXPOSE 8191
 HEALTHCHECK --interval=15m --timeout=30s --start-period=5s --retries=3 CMD [ "curl", "http://localhost:8191/health" ]
 ENTRYPOINT ["uv", "run", "main.py"]