Challenge 1: Add a Non-Root User — Possible Solution
====================================================================

FROM python:3.12-slim
RUN useradd --create-home appuser
WORKDIR /home/appuser/app
COPY --chown=appuser:appuser . .
USER appuser
CMD ["python", "app.py"]

WHY THIS WORKS AS AN ANSWER
------------------------------
useradd --create-home appuser creates a new, unprivileged user (and
its home directory) — the same pattern this chapter's own Node.js
example used, applied here to a Python base image.

WORKDIR is moved into appuser's home directory rather than the root-
owned /app, since a non-root user needs a location it actually has
permission to work in.

COPY --chown=appuser:appuser . . copies the application source and
sets its ownership to appuser directly during the copy — without this,
the files would be copied as root-owned, and the non-root user
wouldn't necessarily have permission to read or execute them once the
container switches away from root.

USER appuser switches the ACTIVE user for every instruction after it
(and, critically, for the container's actual running process at CMD
time) away from root and to the newly created unprivileged user — so
python app.py runs as appuser, not root, limiting what a compromised
process inside this container could do if it were ever exploited.