wip: baseline changes before channel-conversation-task boundary implementation

backend/mci-server/Dockerfile

@@ -1,10 +1,14 @@
 # syntax=docker/dockerfile:1
-FROM eclipse-temurin:21-jre-alpine
+FROM eclipse-temurin:21-jre
 
-RUN apk add --no-cache curl
+RUN groupadd -g 1001 app && \
+    useradd -u 1001 -g app -s /usr/sbin/nologin -M app
 
 WORKDIR /app
 COPY target/*.jar app.jar
+RUN chown app:app app.jar
+
+USER app
 
 EXPOSE 8080
-ENTRYPOINT ["java", "-jar", "app.jar"]
+ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar app.jar"]