dockerfile: run server as non-root