From d3911013469d1b3906216e6cb6edba84a277d15e Mon Sep 17 00:00:00 2001
From: begininvoke <56797886+begininvoke@users.noreply.github.com>
Date: Tue, 18 Aug 2026 20:15:03 -0700
Subject: [PATCH] fix(security): By not specifying a USER, a program in the
 container may run as 'root'. This is a security hazard. If an

---
 images/test_worker/Dockerfile | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/images/test_worker/Dockerfile b/images/test_worker/Dockerfile
index b42da29..42f6422 100644
--- a/images/test_worker/Dockerfile
+++ b/images/test_worker/Dockerfile
@@ -29,4 +29,8 @@ COPY ./$THIS_DIR/handler.py /opt/work_dir/handler.py
 
 ENV LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libtcmalloc.so.4
 
+RUN useradd -m -u 1000 nonroot && \
+    chown -R nonroot:nonroot /opt/work_dir
+USER nonroot
+
 CMD $PY /opt/work_dir/handler.py