dockerfile: run python server as non-root