Update Dockerfile

Dockerfile

@@ -3,10 +3,11 @@ FROM nvidia/cuda:11.3.1-base-ubuntu20.04
 ENV DEBIAN_FRONTEND=noninteractive \
     TZ=Asia/Shanghai \
     LANG=C.UTF-8 \
-    LC_ALL=C.UTF-8
+    LC_ALL=C.UTF-8 \
+    PYTHONUNBUFFERED=1
 
 # ========================
-# Base dependencies
+# Base dependencies (stable minimal set)
 # ========================
 RUN apt-get update && apt-get install -y \
     curl git git-lfs wget unzip zip \
@@ -16,15 +17,17 @@ RUN apt-get update && apt-get install -y \
  && rm -rf /var/lib/apt/lists/*
 
 # ========================
-# OpenVSCode Server (FIXED - NO latest/download)
+# OpenVSCode Server (HARDENED)
 # ========================
 ARG VSCODE_VERSION=1.99.0
 
 RUN mkdir -p /app/openvscode-server && \
-    curl -L -o openvscode.tar.gz \
+    curl -L -o /tmp/openvscode.tar.gz \
     https://github.com/gitpod-io/openvscode-server/releases/download/openvscode-server-v${VSCODE_VERSION}/openvscode-server-v${VSCODE_VERSION}-linux-x64.tar.gz && \
-    tar -xzf openvscode.tar.gz -C /app/openvscode-server --strip-components=1 && \
-    rm openvscode.tar.gz
+    file /tmp/openvscode.tar.gz && \
+    test "$(file /tmp/openvscode.tar.gz | grep -i gzip)" || (echo "❌ Invalid VSCode download" && exit 1) && \
+    tar -xzf /tmp/openvscode.tar.gz -C /app/openvscode-server --strip-components=1 && \
+    rm /tmp/openvscode.tar.gz
 
 # ========================
 # Node.js tools
@@ -34,9 +37,11 @@ RUN curl -fsSL https://deb.nodesource.com/setup_18.x | bash - && \
     npm install -g configurable-http-proxy tsx tslab http-server miniflare@2
 
 # ========================
-# User setup (clean)
+# User setup (clean & safe)
 # ========================
-RUN useradd -m user && mkdir -p /home/user/app && chown -R user:user /home/user
+RUN useradd -m user && \
+    mkdir -p /home/user/app && \
+    chown -R user:user /home/user
 
 ENV HOME=/home/user
 ENV PATH=$HOME/miniconda/bin:$PATH
@@ -53,7 +58,7 @@ RUN curl -sLo ~/miniconda.sh https://repo.anaconda.com/miniconda/Miniconda3-py31
     rm ~/miniconda.sh
 
 # ========================
-# Root setup scripts
+# Root scripts
 # ========================
 USER root
 
@@ -64,7 +69,7 @@ COPY on_startup.sh /root/on_startup.sh
 RUN bash /root/on_startup.sh
 
 # ========================
-# Python dependencies
+# Python deps
 # ========================
 USER user
 
@@ -72,12 +77,12 @@ COPY requirements.txt /home/user/app/
 RUN pip install --no-cache-dir -r requirements.txt
 
 # ========================
-# APP SOURCE (ONLY ONE COPY - FIXED)
+# App source (IMPORTANT FIXED ORDER)
 # ========================
 COPY --chown=user . /home/user/app
 
 # ========================
-# Playwright (optional)
+# Playwright (optional but stable)
 # ========================
 RUN pip install playwright && playwright install --with-deps