Dockerfile runtime stage runs as root — output files on host owned by root

[coderabbitai]

Problem

The runtime stage of the Dockerfile never drops root privileges. As a result, all files written to bind-mounted /data/* paths (outputs, checkpoints, logs, cache, splits) end up owned by root on the host, which is both a security concern (increases the container's blast radius) and a practical inconvenience.

Suggested fix

Add a dedicated non-root system user in the runtime stage, chown the application and data directories to that user, and add a USER directive before ENTRYPOINT:

RUN groupadd --system waterflow \
    && useradd --system --create-home --gid waterflow waterflow

# (after all COPY/mkdir steps)
RUN chown -R waterflow:waterflow /app /data

USER waterflow
ENTRYPOINT ["/app/entrypoint.sh"]

References

• Flagged during code review of PR Creating a Dockerfile #69: Creating a Dockerfile #69 (comment)
• Requested by @marcuscollins