## Final container image runs as root (USER root never reverted)

**Component:** operator-sdk-builder

The Containerfile switches to root for the dnf install layer but never reverts to a non-root user before the image's ENTRYPOINT, so the final built image runs as root by default.

### Remediation
After the dnf install layer, add `USER 1001` (or `USER default`) to revert to the go-toolset non-root user before ENTRYPOINT. If specific tasks genuinely require root, set that in the consuming Tekton Task securityContext rather than baking it into the image.

---
*Source: Ex-Wing/Glasswing Konflux CI security assessment (Mythos), finding FIND-001*