Run apps as non-root user, take 2

Figured I'd take a second pass at this to try and match the existing heroku behavior of not building inside `/tmp` as well as using a random user on each run. (Previous discussion in #42).

The change consists of starting the container with the root user, creating a non-privileged random user, and executing the passed command as that user.