diff --git a/Dockerfile b/Dockerfile
index dd828a4..11dde41 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,6 +9,20 @@ WORKDIR /app
 COPY --from=builder /build/registry .
 COPY --from=builder /app/data/seed.json /app/data/seed.json
 COPY --from=builder /app/internal/docs/swagger.yaml /app/internal/docs/swagger.yaml
+
+# Create a non-privileged user that the app will run under.
+# See https://docs.docker.com/go/dockerfile-user-best-practices/
+ARG UID=10001
+RUN adduser \
+    --disabled-password \
+    --gecos "" \
+    --home "/nonexistent" \
+    --shell "/sbin/nologin" \
+    --no-create-home \
+    --uid "${UID}" \
+    appuser
+
+USER appuser
 EXPOSE 8080
 
 ENTRYPOINT ["./registry"]