diff --git a/Dockerfile b/Dockerfile
index a9d2e74..b0dc007 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,20 +1,33 @@
+# Stage 1: Build environment
 FROM mcr.microsoft.com/dotnet/sdk:10.0-bookworm-slim AS build
+# 1. Explicitly run as root for the build stage
+USER root
 WORKDIR /src
 
+# Copy the project file and restore dependencies
 COPY ["LiteCharmsMessaging/LiteCharmsMessaging.csproj", "LiteCharmsMessaging/"]
 RUN dotnet restore "LiteCharmsMessaging/LiteCharmsMessaging.csproj"
 
+# Copy the rest of the source code
 COPY . .
 
+# Move to the project directory and build the release
 WORKDIR "/src/LiteCharmsMessaging"
 RUN dotnet build "LiteCharmsMessaging.csproj" -c Release -o /app/build
 RUN dotnet publish "LiteCharmsMessaging.csproj" -c Release -o /app/publish /p:UseAppHost=false
 
+# Stage 2: Runtime environment
 FROM mcr.microsoft.com/dotnet/aspnet:10.0-bookworm-slim AS final
 WORKDIR /app
 
-COPY --from=build /app/publish .
+# 2. Switch to the built-in non-root user ('app') before copying files
+USER $APP_UID
 
+# 3. Copy the published output and transfer ownership to the non-root user
+COPY --chown=$APP_UID:$APP_UID --from=build /app/publish .
+
+# .NET 8+ defaults to port 8080 for web apps running as non-root
 EXPOSE 8080
 
+# Start the application
 ENTRYPOINT ["dotnet", "LiteCharmsMessaging.dll"]
\ No newline at end of file