add a placeholder for a bit on nonroot user

Author: hjwp

chapter_10_production_readiness.asciidoc

@@ -660,6 +660,21 @@ $ *git commit -am "Add collectstatic to dockerfile, and new location to gitignor
 ----
 
 
+=== Switching to a nonroot user
+
+TODO: this is definitely a good idea for security, needs writing up.
+
+Dockerfile should gain some lines a bit like this:
+
+.Dockerfile (ch10l0XX)
+====
+[source,dockerfile]
+----
+RUN addgroup --system nonroot && adduser --system --group nonroot
+
+USER nonroot
+----
+
 
 
 === Configuring logging