Update Dockerfile

Dockerfile

@@ -1,47 +1,54 @@
+# Use the official Python slim image
 FROM python:3.10-slim-bookworm
 
-# Set environment variables
+# Set environment variables to control caching and Python behavior
 ENV DEBIAN_FRONTEND=noninteractive
-ENV HF_HUB_ENABLE_HF_TRANSFER=1
+ENV PYTHONUNBUFFERED=1
+ENV PYTHONDONTWRITEBYTECODE=1
 ENV HF_HOME=/app/cache
 ENV NUMBA_CACHE_DIR=/app/cache/numba_cache
-ENV PYTHONUNBUFFERED=1
 ENV CUDA_VISIBLE_DEVICES=""
 
-# Install system dependencies
+# Install essential system dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \
     git \
     build-essential \
     espeak-ng \
     libsndfile1 \
     ffmpeg \
+    curl \
     && rm -rf /var/lib/apt/lists/*
 
 # Set the working directory
 WORKDIR /app
 
-# Create and permission the cache directory
-RUN mkdir -p /app/cache && chmod -R 777 /app/cache
+# ---- START: Non-Root User Configuration ----
+# Create a new user 'appuser' with UID 1000 and create their home directory
+RUN useradd --create-home --uid 1000 appuser
+
+# Create the cache directory and set ownership to the new user
+RUN mkdir -p /app/cache && chown -R appuser:appuser /app /app/cache
 
-# Copy requirements first for better caching
-COPY requirements.txt .
+# Switch to the non-root user
+USER appuser
+# ---- END: Non-Root User Configuration ----
 
-# Install Python dependencies
-RUN pip install --no-cache-dir -U pip && \
-    pip install --no-cache-dir -r requirements.txt
+# Copy requirements file and install dependencies as the non-root user
+COPY --chown=appuser:appuser requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
 
-# Clone NeuTTS Air repository
+# Clone the NeuTTS Air repository
 RUN git clone https://github.com/neuphonic/neutts-air.git
 
 # Copy the application code
-COPY app.py .
+COPY --chown=appuser:appuser app.py .
 
-# Expose the port
+# Expose the application port
 EXPOSE 7860
 
-# Health check
-HEALTHCHECK --interval=30s --timeout=30s --start-period=5s --retries=3 \
+# Add a health check to monitor the application's status
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
     CMD curl -f http://localhost:7860/health || exit 1
 
-# Command to run the application
+# Set the command to run the application
 CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860", "--workers", "1"]