Run as non-root user in dockerfile

Dockerfile

@@ -1,12 +1,18 @@
 FROM python:3.13.5-slim
 
+# Create a non-root user with a known UID for k8s securityContext.runAsUser
+RUN groupadd -g 1000 -r appgroup \
+ && useradd  -u 1000 -r -g appgroup -d /code -s /sbin/nologin appuser
+
 WORKDIR /code
 
 COPY ./requirements.txt /code/requirements.txt
 
 RUN pip install --no-cache-dir --upgrade -r /code/requirements.txt
 
-COPY ./app /code/app
+COPY --chown=appuser:appgroup ./app /code/app
+
+USER appuser
 
-EXPOSE 80
-CMD ["fastapi", "run", "app/main.py", "--port", "80"]
+EXPOSE 8000
+CMD ["fastapi", "run", "app/main.py", "--port", "8000"]

README.md

@@ -38,7 +38,7 @@ BGS Deployed Instance available at: [https://agsapi.bgs.ac.uk/](https://agsapi.b
 The simplest way to run the validation service is via Docker:
 
 ```
-docker run -p 80:80 --name pyagsapi ghcr.io/britishgeologicalsurvey/pyagsapi:latest
+docker run -p 80:8000 --name pyagsapi ghcr.io/britishgeologicalsurvey/pyagsapi:latest
 ```
 
 Navigate to [http://localhost](http://localhost) to see the landing page or [http://localhost/docs](http://localhost/docs) to see the API documentation via the Swagger interface.
@@ -50,7 +50,7 @@ The `latest` tag reflects the current state of the `main` branch of the reposito
 If you are running behind a proxy, you may need to set the `root_path` using the `PYAGSAPI_ROOT_PATH` environment variable:
 
 ```
-docker run -p 80:80 -e PYAGSAPI_ROOT_PATH="/pyagsapi" --name pyagsapi ghcr.io/britishgeologicalsurvey/pyagsapi
+docker run -p 80:8000 -e PYAGSAPI_ROOT_PATH="/pyagsapi" --name pyagsapi ghcr.io/britishgeologicalsurvey/pyagsapi
 ```
 
 This will ensure that all references to `self` in responses, and all Swagger and REDOC documentation, include the correct path.