Update Dockerfile for fetch

Initial patch for podman and SELinux contexts.

Author: trentapple

src/fetch/Dockerfile

@@ -12,8 +12,8 @@ ENV UV_LINK_MODE=copy
 
 # Install the project's dependencies using the lockfile and settings
 RUN --mount=type=cache,target=/root/.cache/uv \
-    --mount=type=bind,source=uv.lock,target=uv.lock \
-    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
+    --mount=type=bind,source=uv.lock,target=uv.lock,Z \
+    --mount=type=bind,source=pyproject.toml,target=pyproject.toml,Z \
     uv sync --frozen --no-install-project --no-dev --no-editable
 
 # Then, add the rest of the project source code and install it
@@ -27,6 +27,9 @@ FROM python:3.12-slim-bookworm
 WORKDIR /app
 
 COPY --from=uv /root/.local /root/.local
+
+# User app does not exist in base image (chown)
+RUN useradd -rUM -s /usr/sbin/nologin app
 COPY --from=uv --chown=app:app /app/.venv /app/.venv
 
 # Place executables in the environment at the front of the path