create unprivileged user

run uvicorn directly instead of via uv

Dockerfile

@@ -41,10 +41,21 @@ COPY README.md ./
 COPY src/ src/
 RUN uv sync --frozen --no-dev
 
-ENV OIDC_OP_ISSUER=http://localhost:8000
+# Use the venv built above directly — avoids `uv run` re-syncing (and
+# needing network access to re-resolve/rebuild) at container startup.
+ENV PATH="/app/.venv/bin:$PATH"
+
+RUN groupadd --system porchlight \
+    && useradd --system --gid porchlight --home-dir /app porchlight \
+    && mkdir -p /app/data \
+    && chown porchlight:porchlight /app/data \
+    && mkdir -p /app/config \
+    && chown porchlight:porchlight /app/config
+
+USER porchlight
 
 EXPOSE 8000
 
-CMD ["uv", "run", "uvicorn", "porchlight.app:create_app", \
+CMD ["uvicorn", "porchlight.app:create_app", \
      "--factory", "--host", "0.0.0.0", "--port", "8000", \
      "--workers", "4"]