add comment on requirements and user in Dockerfile

Author: Xronophobe

chapter_09_docker.asciidoc

@@ -780,6 +780,14 @@ CMD python manage.py runserver
     (this is actually one of the things that `activate` does, under the hood).
 
 <3> We copy our requirements file in, just like the src folder.
+// CSANAD:  It's fine for now, but I would definitely put the requirements under
+//          /tmp and then `rm` it after `pip install`. Also, using a non-privileged
+// user is important, something like:
+//     `adduser --no-create-home --disabled-password todoapp`
+// and then setting the user in the Dockerfile with `USER todoapp`.
+// But we can cover this in a later chapter (the next one looks like a good fit,
+// since it's related to the app being production ready).
+
 
 <4> Now we install our dependencies with `pip`,
     pointing it at our _requirements.txt_.