Improve Docker build

1. Stricter pin for the base image
2. non-root user
3. maybe use wolfi

Start by locating the repository's Dockerfile and build entry point. Review how the base image is selected and whether the container currently runs as root, then check whether Wolfi is already supported or discussed. Done means a reproducible, more strictly pinned image that builds successfully and runs as a non-root user, with the chosen base-image direction documented.

索引モデルが issue の本文から書いたものです。