Discussion: Official support for rootless Docker images

Describe the bug Currently, the official Meilisearch Dockerfile does not specify a non-root user. While this works fine for most setups, it forces the engine to run with elevated privileges inside the container, which goes against the principle of least privilege.

Expected behavior Meilisearch should ideally run as a dedicated meilisearch user. This would provide an extra layer of defense-in-depth, especially since the engine handles sensitive data and is often exposed to the network.

Additional context Implementing this requires careful consideration of volume permissions. If we simply add a USER instruction, existing users might face permission denied errors on their /meili_data volumes due to UID/GID mismatches.

Because of these potential breaking changes, opening a discussion first seemed more appropriate than just pushing a PR. Some options worth considering:

1. Providing a separate -rootless tag.
2. Updating the documentation to guide users through the chown process.
3. Using an entrypoint script that handles permission adjustment if run as root, then drops privileges.

Moving toward a rootless default would significantly improve the security posture of the official image for production environments.