Update Dockerfile

Dockerfile

@@ -1,12 +1,13 @@
+# Use a small Debian-based Python image
 FROM python:3.9-slim
 
 # create non-root user (optional)
 RUN useradd -m -u 1000 user
-
 WORKDIR /app
 
-# install system packages required by chrome + basic tools
-RUN apt-get update && apt-get install -y --no-install-recommends \
+# Install system packages required by Chrome + basic tools
+# Install gnupg so we can add the Google signing key via gpg --dearmor
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
     ca-certificates \
     wget \
     gnupg \
@@ -24,26 +25,26 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libxrandr2 \
     libgbm1 \
     xdg-utils \
+    wget \
     && rm -rf /var/lib/apt/lists/*
 
-# install Google Chrome stable
-RUN wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add - \
- && echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" \
+# Add Google Chrome stable repository (secure method using signed-by keyring)
+RUN wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | gpg --dearmor \
+    > /usr/share/keyrings/google-linux-signing-key.gpg \
+    && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-linux-signing-key.gpg] http://dl.google.com/linux/chrome/deb/ stable main" \
     > /etc/apt/sources.list.d/google-chrome.list \
- && apt-get update \
- && apt-get install -y --no-install-recommends google-chrome-stable \
- && rm -rf /var/lib/apt/lists/*
+    && apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends google-chrome-stable \
+    && rm -rf /var/lib/apt/lists/*
 
-# set environment variable so our code can pick up binary if needed
+# Expose CHROME_BIN to the app (used by app.py)
 ENV CHROME_BIN=/usr/bin/google-chrome-stable
 
-# install python dependencies
-COPY --chown=user ./requirements.txt requirements.txt
+# Copy and install Python dependencies
+COPY requirements.txt ./requirements.txt
 RUN pip install --no-cache-dir --upgrade -r requirements.txt
 
-COPY --chown=user . /app
-
-# optionally run as non-root user (uncomment if you want)
-# USER user
+# Copy app
+COPY . /app
 
+# Ensure the entrypoint runs uvicorn; run as root (if you want non-root, adjust flags)
 CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860"]