fix: run as non-root user

Dockerfile

@@ -17,13 +17,9 @@ RUN apt-get update && apt-get install -y \
     gcc \
     g++ \
     nginx \
-    supervisor \
     curl \
     && rm -rf /var/lib/apt/lists/*
 
-# Create non-root user for HF Spaces
-RUN useradd -m -u 1000 user
-
 # Set working directory
 WORKDIR /app
 
@@ -35,69 +31,61 @@ RUN pip install --no-cache-dir -r requirements.txt
 COPY backend/ ./backend/
 
 # Copy built frontend to nginx directory
-COPY --from=frontend-builder /app/frontend/dist /usr/share/nginx/html
+COPY --from=frontend-builder /app/frontend/dist /var/www/html
 
 # Create nginx configuration
-RUN echo 'server { \n\
-    listen 7860; \n\
-    server_name localhost; \n\
-    \n\
-    location / { \n\
-        root /usr/share/nginx/html; \n\
-        try_files $uri $uri/ /index.html; \n\
-    } \n\
-    \n\
-    location /api { \n\
-        proxy_pass http://127.0.0.1:8000; \n\
-        proxy_http_version 1.1; \n\
-        proxy_set_header Upgrade $http_upgrade; \n\
-        proxy_set_header Connection "upgrade"; \n\
-        proxy_set_header Host $host; \n\
-        proxy_set_header X-Real-IP $remote_addr; \n\
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; \n\
-        proxy_set_header X-Forwarded-Proto $scheme; \n\
-        proxy_read_timeout 300s; \n\
-        proxy_connect_timeout 300s; \n\
+RUN echo 'error_log /dev/stderr; \n\
+pid /tmp/nginx.pid; \n\
+worker_processes auto; \n\
+events { worker_connections 1024; } \n\
+http { \n\
+    include /etc/nginx/mime.types; \n\
+    default_type application/octet-stream; \n\
+    access_log /dev/stdout; \n\
+    client_body_temp_path /tmp/client_body; \n\
+    proxy_temp_path /tmp/proxy; \n\
+    fastcgi_temp_path /tmp/fastcgi; \n\
+    uwsgi_temp_path /tmp/uwsgi; \n\
+    scgi_temp_path /tmp/scgi; \n\
+    server { \n\
+        listen 7860; \n\
+        server_name localhost; \n\
+        root /var/www/html; \n\
+        index index.html; \n\
+        location / { \n\
+            try_files $uri $uri/ /index.html; \n\
+        } \n\
+        location /api { \n\
+            proxy_pass http://127.0.0.1:8000; \n\
+            proxy_http_version 1.1; \n\
+            proxy_set_header Upgrade $http_upgrade; \n\
+            proxy_set_header Connection "upgrade"; \n\
+            proxy_set_header Host $host; \n\
+            proxy_read_timeout 300s; \n\
+        } \n\
     } \n\
-}' > /etc/nginx/conf.d/default.conf
+}' > /etc/nginx/nginx.conf
 
-# Remove default nginx config that listens on port 80
-RUN rm -f /etc/nginx/sites-enabled/default 2>/dev/null || true
+# Create startup script
+RUN echo '#!/bin/bash \n\
+mkdir -p /tmp/client_body /tmp/proxy /tmp/fastcgi /tmp/uwsgi /tmp/scgi \n\
+cd /app && python -m uvicorn backend.app.main:app --host 0.0.0.0 --port 8000 & \n\
+sleep 2 \n\
+nginx -g "daemon off;"' > /app/start.sh && chmod +x /app/start.sh
 
-# Create supervisor configuration
-RUN echo '[supervisord] \n\
-nodaemon=true \n\
-user=root \n\
-\n\
-[program:backend] \n\
-command=python -m uvicorn backend.app.main:app --host 0.0.0.0 --port 8000 \n\
-directory=/app \n\
-autostart=true \n\
-autorestart=true \n\
-redirect_stderr=true \n\
-stdout_logfile=/dev/stdout \n\
-stdout_logfile_maxbytes=0 \n\
-\n\
-[program:nginx] \n\
-command=nginx -g "daemon off;" \n\
-autostart=true \n\
-autorestart=true \n\
-redirect_stderr=true \n\
-stdout_logfile=/dev/stdout \n\
-stdout_logfile_maxbytes=0' > /etc/supervisor/conf.d/supervisord.conf
+# Set permissions for non-root user
+RUN chmod -R 777 /var/www/html /var/log/nginx /var/lib/nginx /etc/nginx /app
 
-# Create persistent data directory and set permissions
-RUN mkdir -p /data && chown -R 1000:1000 /data
-RUN chown -R 1000:1000 /app
-RUN chown -R 1000:1000 /usr/share/nginx/html
-RUN touch /var/run/nginx.pid && chown 1000:1000 /var/run/nginx.pid
-RUN chown -R 1000:1000 /var/log/nginx /var/lib/nginx
+# Create data directory
+RUN mkdir -p /data && chmod 777 /data
 
-# Set environment for database path
+# Environment
 ENV DATABASE_PATH=/data/project_memory.db
 
-# Hugging Face Spaces expects port 7860
+# HF Spaces port
 EXPOSE 7860
 
-# Start both services with supervisor
-CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]
+# Run as non-root
+USER 1000
+
+CMD ["/bin/bash", "/app/start.sh"]