Why run as non-root and what other hardening do you apply to a production image?

By default containers run as root (UID 0); a compromised app then has root inside the container, easing container escape and host access, so you create and switch to a non-root user (USER appuser) — many cluster policies require it.

Beyond that: pin a specific minimal base image (distroless/Alpine/JRE-only) rather than latest, run with a read-only root filesystem and drop Linux capabilities, scan images for CVEs in CI, and never bake secrets into layers since they persist in image history even if later deleted.