# ADR-0007: Run the simulator image as a non-root user

## Status

Accepted (2026-07-08)

## Context

The Trivy scan in CI flagged **DS-0002**: the simulator image ran as `root`
because no `USER` was set. A container writing the data lake as root also
produces root-owned Parquet on bind mounts, which then blocks a later non-root
process from the same files.

## Decision

Create a dedicated unprivileged user **`swarm` (uid/gid 10001)** in the
`simulator/Dockerfile` and switch to it with `USER swarm` before the entrypoint.
The uid is fixed (not auto-assigned) so host-side ownership of the shared data
paths ([ADR-0008](ADR-0008-runtime-data-paths.md)) is deterministic.

## Consequences

- Trivy DS-0002 clears; the image follows least-privilege.
- Bind-mounted data is owned by `10001:10001`; host prep (`sim-cluster.yml`) and
  Ansible `chown` the `var/t1` / `var/t3` paths to this uid so k3d pods can write.
- Any future service image reusing this data must run as the same uid or share
  the group.