security(docker): enforce non-root execution context (CWE-250)

[iamkdeepesh]

🔒 Security & Hardening: [Fix CWE-250] Enforce Least Privilege in Container Configurations

Summary

This Pull Request addresses a container security finding by enforcing non-root user execution across runtime configuration files without altering functional application behavior.

Identified Weakness

• CWE ID: CWE-250: Execution with Unnecessary Privileges
• Target Files: Container configurations in sunbird-rc-core
• Risk Description: Running application processes as the container superuser (root) poses a security risk if an execution vulnerability is exploited, allowing potential container escape with host-level root privileges.

Proposed Changes

• Container Execution Context: Injected unprivileged system user (appuser) and group (appgroup) definitions before entrypoint execution.

Validation & Testing

• Local Build Verification: Dockerfile/manifest syntax validated.
• Static Analysis Check: Verified remediation of CWE-250 rule.

---

This submission is part of an academic research initiative on Digital Public Infrastructure security posture at IIT Tirupati.