INF-1650: run agentql-mcp container as non-root user

[andriy-sudo]

What

Clears the Semgrep finding dockerfile.security.missing-user.missing-user (ERROR) at Dockerfile:21 from the fresh org-wide SAST scan (INF-1650). The container had no USER instruction, so the MCP server ran as root.

How

Add USER node before CMD. The node:20-alpine base image ships a non-privileged node user (uid 1000); the build artifacts under /app are world-readable, so the runtime needs only read access — no chown required.

Verification

• Before: semgrep --config p/dockerfile → 1 finding (missing-user)
• After: → 0 findings
• npm run build / npm run lint (the repo CI) are unaffected — the change only adds a runtime USER.

Closes INF-1650.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0418013f-184e-49ad-9253-68e4f211a3d3

📥 Commits

Reviewing files that changed from the base of the PR and between 8a634e6 and 860ebe5.

📒 Files selected for processing (1)

• Dockerfile

---

📝 Walkthrough

Walkthrough

This PR modifies the Dockerfile to run the container as the non-root node user instead of the default user. The change adds a USER node directive at the end of the Dockerfile along with inline comments documenting that the base image already provides this non-privileged user and that build artifacts are world-readable, so elevated privileges are not required for runtime read operations.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The pull request title clearly summarizes the main change: adding a USER instruction to run the container as a non-root user, which directly corresponds to the Dockerfile modification.
Description check	✅ Passed	The pull request description is well-related to the changeset, explaining the purpose (fixing Semgrep finding), the implementation (adding USER node), and verification steps.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch andriy/inf-1650-dockerfile-nonroot-user

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}