Other security controls aside, for the user thing we make it mandatory to have USER directive in the Dockerfile, else the docker builds fail.