Design container to run as non-root