Possible by not specifying a USER, a program in the container may run as 'root' in Dockerfile

This might be a false positive, but `.github/docker/hawk-node.tumbleweed/Dockerfile` around line 28 looked worth a second pair of eyes.

The Dockerfile does not set a non‑root user, so the container starts the systemd process as root (the default). Running as root gives any compromise inside the container full privileges on the host namespace, increasing the impact from container escape to host takeover. This is classified as CWE‑250 (Execution with Unnecessary Privileges) and is rated high risk because attackers can leverage root privileges to modify system files, install backdoors, or pivot to other containers and the host.

The code in question

```
CMD ["/usr/lib/systemd/systemd", "--system"]
```

Something like this might fix it:

```
*** Begin Patch
*** Update File: .github/docker/hawk-node.tumbleweed/Dockerfile
@@
-# (previous Dockerfile content)
-CMD ["/usr/lib/systemd/systemd", "--system"]
+# Create a non‑privileged user to run the application
+RUN groupadd -r appgroup && \
+ useradd -r -g appgroup -d /home/appuser -s /sbin/nologin appuser
+
+# Switch to the non‑root user before launching the main process
+USER appuser
+
+CMD ["/usr/lib/systemd/systemd", "--system"]
*** End Patch
```

For reference: rule `dockerfile.security.missing-user.missing-user`, [CWE-250 (Execution with Unnecessary Privileges)](https://cwe.mitre.org/data/definitions/250.html). Rated high.

The suggested change is untested against this project, so please read it before applying it.

---
*Found with automated scanning ([RedGem](https://code.redgem.net)) and reviewed before opening. If it is not useful, closing it is completely fine.*

Start with .github/docker/hawk-node.tumbleweed/Dockerfile around line 28 and inspect how the systemd CMD is launched. Check whether the proposed non-root configuration is compatible with this container, then build and run the image to verify its startup and privilege behavior. Done means the container runs with only the required privileges without breaking systemd or the existing image workflow.

Written by the indexing model from the issue text.