Improve Docker build

1. Stricter pin for the base image
2. non-root user
3. maybe use wolfi

Start by locating the repository's Dockerfile and build entry point. Review how the base image is selected and whether the container currently runs as root, then check whether Wolfi is already supported or discussed. Done means a reproducible, more strictly pinned image that builds successfully and runs as a non-root user, with the chosen base-image direction documented.

由索引模型根据 Issue 内容生成。