fix: make ECS Docker container non-root

Author: TotalDwarf03

Dockerfile

@@ -16,6 +16,10 @@ RUN poetry install --only main --no-root
 # Expose the port the app runs on
 EXPOSE 8501
 
+# Run as non-root user for security
+RUN useradd -m appuser
+USER appuser
+
 # Run the dashboard
 # Note: ENTRYPOINT cannot be overriden by docker run command
 ENTRYPOINT ["poetry", "run", "streamlit", "run", "src/app.py", "--server.port=8501", "--server.address=0.0.0.0"]

terraform/dashboard/main.tf

@@ -33,6 +33,7 @@ resource "aws_ecs_task_definition" "ecs_service_definition" {
           appProtocol   = "http"
         }
       ],
+      readonlyRootFilesystem = true,
       environment = [
         {
           name  = "AWS_ACCESS_KEY_ID"