tests pass under app user

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:6.13.0
+FROM node:6.13.0 as app
 
 COPY ./ /app
 
@@ -6,11 +6,22 @@ WORKDIR /app
 
 RUN npm install
 
+
+RUN npm run compile:all
+
+FROM node:6.13.0
+
+COPY --from=app /app /app
+
+WORKDIR /app
+
+
+# All app and node_modules will be owned by root.
+# The app will run as the 'app' user, and so not have write permissions
+# on any files it doesn't need.
+RUN useradd --user-group --create-home --home-dir /app --shell /bin/bash app
+
 RUN [ -e ./install_deps.sh ] && ./install_deps.sh
 
-RUN npm run compile
-
-ENV SHARELATEX_CONFIG /app/config/settings.production.coffee
-ENV NODE_ENV production
-
-CMD ["node","/app/app.js"]
+USER app
+CMD ["node","app.js"]