FROM debian:bookworm-slim

LABEL parent-images=debian12

RUN adduser -u 1010 --disabled-password --comment "" worker

# Run updates
RUN apt-get -y update \
  && apt-get -y upgrade \
  && apt-get -y clean \
  && rm -rf /var/lib/apt/lists/*

# Remove setuid/setgid bits
RUN find / -perm /6000 -type f -exec chmod a-s {} \; || true

# Run container as the worker user
USER worker