Update Dockerfile

Dockerfile

@@ -1,26 +1,36 @@
-# Use an official Python runtime as a parent image
-FROM python:3.10-slim
+# Use a specific, stable version of the slim image
+FROM python:3.10.13-slim-bullseye
 
-# Set the working directory in the container
-WORKDIR /code
+# Set environment variables to prevent interactive prompts during build
+ENV DEBIAN_FRONTEND=noninteractive
+ENV PYTHONUNBUFFERED=1
 
-# Set a writeable cache directory for Hugging Face models
-ENV HF_HOME /code/.cache
+# Install git and other system dependencies as root
+RUN apt-get update && apt-get install -y --no-install-recommends git curl && \
+    apt-get clean && rm -rf /var/lib/apt/lists/*
 
-# NEW: Install git into the container
-RUN apt-get update && apt-get install -y git
+# Create a non-root user and its home directory
+RUN useradd -m -u 1000 user
+WORKDIR /home/user/code
 
-# Copy the requirements file into the container
-COPY ./requirements.txt /code/requirements.txt
+# Set the cache directory for Hugging Face libraries
+# This directory will be created with the correct ownership later
+ENV HF_HOME=/home/user/code/.cache
+ENV PATH="/home/user/.local/bin:${PATH}"
 
-# Install any needed packages specified in requirements.txt
-RUN pip install --no-cache-dir --upgrade -r /code/requirements.txt
+# Copy requirements file and install dependencies as the new user
+# First, change ownership of the destination directory
+RUN chown -R user:user /home/user/code
+USER user
 
-# Copy the rest of the application code into the container
-COPY ./app.py /code/app.py
+COPY --chown=user:user ./requirements.txt .
+RUN pip install --no-cache-dir --upgrade -r requirements.txt
 
-# Make port 7860 available to the world outside this container
+# Copy the rest of the application code
+COPY --chown=user:user ./app.py .
+
+# Expose the port
 EXPOSE 7860
 
-# Run app.py when the container launches
+# Run the application
 CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860"]