curo1305andClaude Sonnet 4.6
378822682c
- backend/Dockerfile: two-stage build (builder/runtime); runtime stage creates appuser uid=1000, copies installed packages from discardable builder stage, runs as non-root USER appuser; no --reload baked in CMD - docker-compose.yml: backend + celery-worker get read_only:true, tmpfs:/tmp:mode=1777, cap_drop:ALL, security_opt:no-new-privileges:true; celery-beat intentionally left unhardened (Pitfall 7 — writes celerybeat-schedule) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>