UPDATE:

Dockerfile

@@ -1,17 +1,42 @@
+# 1. Start from a slim, official Python base image
 FROM python:3.12-slim
 
-COPY . /app
+# 2. Set environment variables
+#    - Prevents Python from writing .pyc files
+#    - Prevents Python from buffering stdout and stderr
+#    - Sets the location for uv's cache to a user-owned directory
+ENV PYTHONDONTWRITEBYTECODE 1
+ENV PYTHONUNBUFFERED 1
 
+# 3. Set the working directory
 WORKDIR /app
 
-USER root
+# 4. Create a non-root user to run the application
+#    This is a critical security best practice.
+RUN useradd --create-home --shell /bin/bash appuser
 
+# 5. Install uv globally (as root, which is fine for this step)
 RUN pip install uv
 
-RUN uv sync
+# 6. Copy only the dependency file first to leverage Docker's layer caching
+COPY pyproject.toml ./
 
-RUN chmod -R 777 /app
+# 7. Install dependencies. This layer will only be re-built if pyproject.toml changes.
+#    We also ensure the virtual environment is created with correct ownership.
+RUN uv sync --system-site-packages && \
+    chown -R appuser:appuser /app/.venv
 
-EXPOSE 7860
+# 8. Copy the rest of the application source code
+COPY . .
 
+# 9. Change ownership of the entire app directory to the non-root user
+RUN chown -R appuser:appuser /app
+
+# 10. Switch to the non-root user
+USER appuser
+
+# 11. Expose the correct port that the application runs on
+EXPOSE 8000
+
+# 12. Define the command to run the application
 CMD ["uv", "run", "main.py"]