Harden Docker container security

Run as non-root user (fixes Claude Code refusing bypassPermissions as
root, which caused all agent spawns to exit instantly with no session).
Add read-only root filesystem, drop all capabilities, set
no-new-privileges, bind port to localhost only, and require
GIT_USER_NAME/GIT_USER_EMAIL env vars at startup.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker/Dockerfile

@@ -33,10 +33,6 @@ RUN curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C /usr/local/bin
 # The CLI binary is `claude`.
 RUN npm install -g @anthropic-ai/claude-code
 
-# ── Biome (frontend linter) ─────────────────────────────────────────
-# Installed project-locally via npm install, but having it global avoids
-# needing node_modules for CI-style checks.
-
 # ── Working directory ────────────────────────────────────────────────
 # /app holds the storkit source (copied in at build time for the binary).
 # /workspace is where the target project repo gets bind-mounted at runtime.
@@ -98,6 +94,22 @@ COPY --from=base /usr/local/bin/storkit /usr/local/bin/storkit
 # Alternative: mount the source as a volume.
 COPY --from=base /app /app
 
+# ── Non-root user ────────────────────────────────────────────────────
+# Claude Code refuses --dangerously-skip-permissions (bypassPermissions)
+# when running as root. Create a dedicated user so agents can launch.
+RUN groupadd -r storkit \
+    && useradd -r -g storkit -m -d /home/storkit storkit \
+    && mkdir -p /home/storkit/.claude \
+    && chown -R storkit:storkit /home/storkit \
+    && chown -R storkit:storkit /usr/local/cargo /usr/local/rustup \
+    && chown -R storkit:storkit /app
+
+# ── Entrypoint ───────────────────────────────────────────────────────
+# Validates required env vars (GIT_USER_NAME, GIT_USER_EMAIL) and
+# configures git identity before starting the server.
+COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
+
+USER storkit
 WORKDIR /workspace
 
 # ── Ports ────────────────────────────────────────────────────────────
@@ -105,11 +117,9 @@ WORKDIR /workspace
 EXPOSE 3001
 
 # ── Volumes (defined in docker-compose.yml) ──────────────────────────
-# /workspace           – bind mount: target project repo
-# /root/.claude        – named volume: Claude Code sessions/state
-# /usr/local/cargo/registry – named volume: cargo dependency cache
+# /workspace                    – bind mount: target project repo
+# /home/storkit/.claude         – named volume: Claude Code sessions/state
+# /usr/local/cargo/registry     – named volume: cargo dependency cache
 
-# ── Entrypoint ───────────────────────────────────────────────────────
-# Run storkit against the bind-mounted project at /workspace.
-# The server picks up ANTHROPIC_API_KEY from the environment.
+ENTRYPOINT ["entrypoint.sh"]
 CMD ["storkit", "/workspace"]