Update

Dockerfile

@@ -1,65 +1,66 @@
+# ─────────────────────────── base image ───────────────────────────
 FROM ghcr.io/astral-sh/uv:python3.12-bookworm-slim
 
-# ---------- build args ----------
 ARG PORT=8001
 ARG TRANSPORT_SERVER_URL=https://blanchon-robothub-transportserver.hf.space/api
 
-# ---------- system packages ----------
-RUN apt-get update && apt-get install -y --no-install-recommends \
-        build-essential gcc g++ \
-        libgl1-mesa-glx libglib2.0-0 libsm6 libxext6 libxrender-dev libgomp1 \
-        ffmpeg git \
-    && apt-get clean && rm -rf /var/lib/apt/lists/*
-
-# ---------- app user ----------
-RUN groupadd -r appuser && useradd -m -r -g appuser -s /bin/bash appuser
-
-# ---------- cache directories & environment ----------
-ENV HOME=/home/appuser
-ENV \
-    HF_HOME=$HOME/.cache \
-    HF_HUB_CACHE=$HOME/.cache/hub \
-    HUGGINGFACE_HUB_CACHE=$HOME/.cache/hub \
-    TRANSFORMERS_CACHE=$HOME/.cache/huggingface/hub \
-    UV_CACHE_DIR=$HOME/.cache/uv \
-    PYTHONUNBUFFERED=1 \
+# ──────────────────────── core environment ────────────────────────
+ENV PYTHONUNBUFFERED=1 \
     PYTHONDONTWRITEBYTECODE=1 \
     UV_SYSTEM_PYTHON=1 \
     UV_COMPILE_BYTECODE=1 \
     PORT=${PORT} \
     TRANSPORT_SERVER_URL=${TRANSPORT_SERVER_URL}
 
-# create the caches while still root, then chown to appuser
-RUN mkdir -p "$HF_HUB_CACHE" "$TRANSFORMERS_CACHE" "$UV_CACHE_DIR" \
-    && chown -R appuser:appuser "$HOME/.cache"
+# ────────────────────────── OS packages ───────────────────────────
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        build-essential gcc g++ \
+        libgl1-mesa-glx libglib2.0-0 libsm6 libxext6 libxrender-dev libgomp1 \
+        ffmpeg git && \
+    apt-get clean && rm -rf /var/lib/apt/lists/*
 
-# switch to non-root user (no inline comment!)
-USER appuser
+# ────────────────────────── app user ──────────────────────────────
+RUN groupadd -r appuser && useradd -m -r -g appuser -s /bin/bash appuser
+ENV HOME=/home/appuser
+ENV USER=appuser
+
+# All caches live in the user’s home → no writes to system paths
+ENV HF_HOME=$HOME/.cache/huggingface \
+    HF_HUB_CACHE=$HOME/.cache/huggingface/hub \
+    TRANSFORMERS_CACHE=$HOME/.cache/huggingface/transformers \
+    XDG_CACHE_HOME=$HOME/.cache \
+    UV_CACHE_DIR=$HOME/.cache/uv
 
-# ---------- workdir ----------
+RUN mkdir -p $HF_HUB_CACHE $TRANSFORMERS_CACHE $UV_CACHE_DIR && \
+    chown -R $USER:$USER $HOME/.cache
+
+# ───────────────────────── project code ───────────────────────────
 WORKDIR /app
 
-# ---------- copy manifests first ----------
-COPY --chown=appuser:appuser pyproject.toml uv.lock* ./
-COPY --chown=appuser:appuser external/ ./external/
+# 1️⃣ copy lockfiles first for layer-caching
+COPY pyproject.toml uv.lock* /app/
+COPY external/ /app/external/
 
-# ---------- install deps ----------
-RUN --mount=type=cache,target=$UV_CACHE_DIR,uid=1000,gid=1000 \
+RUN --mount=type=cache,target=/tmp/uv-cache \
     uv sync --locked --no-install-project --no-dev
 
-# ---------- copy source ----------
-COPY --chown=appuser:appuser . .
+# 2️⃣ copy the rest & install the project
+COPY . /app/
+RUN chown -R $USER:$USER /app
 
-# ---------- install the project itself ----------
-RUN --mount=type=cache,target=$UV_CACHE_DIR,uid=1000,gid=1000 \
+RUN --mount=type=cache,target=/tmp/uv-cache \
     uv sync --locked --no-editable --no-dev
 
-# ---------- virtual-env path ----------
-ENV PATH="/app/.venv/bin:$PATH"
+# ───────────────────────── runtime user ───────────────────────────
+USER appuser
 
-# ---------- runtime ----------
+# Expose port (parameterized)
 EXPOSE ${PORT}
+
+# Health check
 HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
-    CMD python -c "import urllib.request, os; urllib.request.urlopen(f'http://localhost:{os.getenv(\"PORT\")}/api/health')" || exit 1
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:${PORT}/api/health')" || exit 1
 
-CMD ["sh", "-c", "python launch_simple.py --host 0.0.0.0 --port ${PORT} --transport-server-url ${TRANSPORT_SERVER_URL}"]
+# Run the application
+CMD ["sh", "-c", "python launch_simple.py --host 0.0.0.0 --port ${PORT} --transport-server-url ${TRANSPORT_SERVER_URL}"]