FROM alpine:3.22
# a non-root service account with a fixed numeric ID, and a data directory it owns
RUN adduser -D -H -u 10001 app \
 && mkdir -p /data \
 && chown 10001:10001 /data
USER 10001
