Update Dockerfile

Dockerfile

@@ -1,9 +1,10 @@
 FROM nvidia/cuda:12.5.1-cudnn-devel-ubuntu20.04
 
 ENV DEBIAN_FRONTEND=noninteractive \
-    TZ=Europe/Paris
+	TZ=Europe/Paris
 
-# Remove any third-party apt sources and install utilities
+# Remove any third-party apt sources to avoid issues with expiring keys.
+# Install some basic utilities
 RUN rm -f /etc/apt/sources.list.d/*.list && \
     apt-get update && apt-get install -y --no-install-recommends \
     curl \
@@ -25,28 +26,31 @@ RUN rm -f /etc/apt/sources.list.d/*.list && \
     software-properties-common \
  && rm -rf /var/lib/apt/lists/*
 
-# Add nvtop for monitoring Nvidia GPUs
 RUN add-apt-repository ppa:flexiondotorg/nvtop && \
     apt-get upgrade -y && \
     apt-get install -y --no-install-recommends nvtop
 
-# Install Node.js
 RUN curl -sL https://deb.nodesource.com/setup_21.x  | bash - && \
     apt-get install -y nodejs && \
     npm install -g configurable-http-proxy
 
-# Create a non-root user
+# Create a working directory
+WORKDIR /app
+
+# Create a non-root user and switch to it, but give the user root privileges
 RUN adduser --disabled-password --gecos '' --shell /bin/bash user \
- && usermod -aG sudo user \  # Add user to sudo group
- && echo "user ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/90-user \
- && chown -R user:user /app /home/user  # Ensure ownership
+ && usermod -aG root user \
+ && chown -R user:user /app
+
+RUN echo "user ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/90-user
+USER user
 
-# Set the home directory and permissions
+# All users can use /home/user as their home directory
 ENV HOME=/home/user
 RUN mkdir $HOME/.cache $HOME/.config \
  && chmod -R 777 $HOME
 
-# Install Miniconda for the user
+# Set up the Conda environment
 ENV CONDA_AUTO_UPDATE_CONDA=false \
     PATH=$HOME/miniconda/bin:$PATH
 RUN curl -sLo ~/miniconda.sh https://repo.continuum.io/miniconda/Miniconda3-py39_4.10.3-Linux-x86_64.sh \
@@ -55,36 +59,49 @@ RUN curl -sLo ~/miniconda.sh https://repo.continuum.io/miniconda/Miniconda3-py39
  && rm ~/miniconda.sh \
  && conda clean -ya
 
-# Set up application folder
 WORKDIR $HOME/app
 
-# Copy any necessary files and set ownership
-COPY --chown=user . $HOME/app
+#######################################
+# Start root user section
+#######################################
 
-# Make the start script executable
-RUN chmod +x start_server.sh
+USER root
 
-# Replace the login.html file
-COPY --chown=user login.html /home/user/miniconda/lib/python3.9/site-packages/jupyter_server/templates/login.html
+# User Debian packages
+## Security warning : Potential user code executed as root (build time)
+RUN --mount=target=/root/packages.txt,source=packages.txt \
+    apt-get update && \
+    xargs -r -a /root/packages.txt apt-get install -y --no-install-recommends \
+    && rm -rf /var/lib/apt/lists/*
 
-# Set environment variables for Gradio
-ENV PYTHONUNBUFFERED=1 \
-    GRADIO_ALLOW_FLAGGING=never \
-    GRADIO_NUM_PORTS=1 \
-    GRADIO_SERVER_NAME=0.0.0.0 \
-    GRADIO_THEME=huggingface \
-    SYSTEM=spaces \
-    SHELL=/bin/bash
+RUN --mount=target=/root/on_startup.sh,source=on_startup.sh,readwrite \
+	bash /root/on_startup.sh
 
-# Ensure the user has proper permissions
-RUN chown -R user:user /data /app /home/user
+RUN mkdir /data && chown user:user /data
 
-# Switch to the non-root user
-USER user
+#######################################
+# End root user section
+#######################################
+
+USER root
 
-# Install Python dependencies
+# Python packages
 RUN --mount=target=requirements.txt,source=requirements.txt \
     pip install --no-cache-dir --upgrade -r requirements.txt
 
-# Start the server
+# Copy the current directory contents into the container at $HOME/app setting the owner to the user
+COPY --chown=user . $HOME/app
+
+RUN chmod +x start_server.sh
+
+COPY --chown=user login.html /home/user/miniconda/lib/python3.9/site-packages/jupyter_server/templates/login.html
+
+ENV PYTHONUNBUFFERED=1 \
+	GRADIO_ALLOW_FLAGGING=never \
+	GRADIO_NUM_PORTS=1 \
+	GRADIO_SERVER_NAME=0.0.0.0 \
+	GRADIO_THEME=huggingface \
+	SYSTEM=spaces \
+	SHELL=/bin/bash
+
 CMD ["./start_server.sh"]