Update Dockerfile to run as non-root, and to add user before any installs to ensure consistent IDs