Update Dockerfile

Dockerfile

@@ -1,33 +1,43 @@
 # Dockerfile — minimal image to run the Mini Transformer Chainlit UI
-# Uses a slim Python base. For GPU/CUDA you should use a CUDA-enabled base image
-# and install a matching torch wheel.
+# Uses a slim Python base. For GPU/CUDA use a CUDA-enabled base image.
 
 FROM python:3.11-slim
 
-ENV PYTHONUNBUFFERED=1
-WORKDIR /app
+# --- Create non-root user (HF Spaces runs as UID 1000) ---
+RUN useradd -m -u 1000 user
+ENV HOME=/home/user \
+    PATH=/home/user/.local/bin:$PATH \
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1
 
-# Install build deps (kept minimal) and git for potential installs from repo
+# --- System deps ---
 RUN apt-get update \
     && apt-get install -y --no-install-recommends build-essential git curl \
     && rm -rf /var/lib/apt/lists/*
 
-# Copy project into the image
-COPY . /app
+# --- Use a writable app dir owned by UID 1000 ---
+WORKDIR /home/user/app
 
-# Upgrade pip
-RUN pip install --upgrade pip setuptools wheel
+# --- Copy project (own it as UID 1000 to avoid permission issues) ---
+COPY --chown=1000:1000 . .
 
-# Install Python deps: prefer requirements.txt if present, otherwise install package with [server] extras
-RUN if [ -f requirements.txt ]; then \
+# --- Python deps ---
+RUN pip install --upgrade pip setuptools wheel && \
+    if [ -f requirements.txt ]; then \
       pip install -r requirements.txt; \
     else \
       pip install .[server]; \
     fi
 
-# Expose default Chainlit port
+# --- Optional: make Chainlit's .files persistent/writable (HF Spaces) ---
+# RUN mkdir -p /data/chainlit_files && chown -R 1000:1000 /data/chainlit_files && ln -s /data/chainlit_files ./.files
+
+# --- Run as non-root ---
+USER 1000:1000
+
+# --- Networking ---
 EXPOSE 7860
 ENV PORT=7860
 
-# Default command: launch Chainlit to run the packaged chainlit_app
+# --- Launch Chainlit ---
 CMD ["bash", "-c", "chainlit run src/mini_transformer/apps/chainlit_app.py --host 0.0.0.0 --port ${PORT}"]