[verified] feat(deploy): run v0.1.2 as non-root

Dockerfile

@@ -11,6 +11,8 @@ ENV PYTHONUNBUFFERED=1 \
     JARCA_MCP_HOST=0.0.0.0 \
     JARCA_MCP_PORT=8000 \
     JARCA_MCP_STREAMABLE_HTTP_PATH=/mcp \
+    HOME=/home/jarca \
+    TMPDIR=/tmp \
     PATH=/app/.venv/bin:$PATH
 
 COPY --from=uv /uv /uvx /usr/local/bin/
@@ -20,9 +22,15 @@ WORKDIR /app
 COPY pyproject.toml uv.lock README.md ./
 RUN uv sync --frozen --no-dev --extra dashboard --no-install-project
 
-COPY jarca_ledger_mcp ./jarca_ledger_mcp
-COPY dashboard ./dashboard
-RUN uv sync --frozen --no-dev --extra dashboard
+RUN groupadd --gid 1000 jarca \
+    && useradd --uid 1000 --gid 1000 --create-home --home-dir /home/jarca --shell /usr/sbin/nologin jarca \
+    && chown -R 1000:1000 /home/jarca \
+    && install -d -o 1000 -g 1000 -m 0770 /data
+
+COPY --chown=1000:1000 jarca_ledger_mcp ./jarca_ledger_mcp
+COPY --chown=1000:1000 dashboard ./dashboard
+RUN uv sync --frozen --no-dev --extra dashboard \
+    && chmod -R a+rX /app
 
 VOLUME ["/data"]
 EXPOSE 8000 8501
@@ -30,4 +38,6 @@ EXPOSE 8000 8501
 HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
     CMD python -c "import os, socket; s=socket.create_connection(('127.0.0.1', int(os.getenv('JARCA_MCP_PORT', '8000'))), timeout=3); s.close()"
 
+USER 1000:1000
+
 CMD ["jarca-ledger-mcp"]