.

Dockerfile

@@ -1,23 +1,34 @@
 FROM python:3.13-slim
 
+# system deps
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl build-essential git \
+    curl git build-essential \
  && rm -rf /var/lib/apt/lists/*
 
-# Install uv
-RUN curl -LsSf https://astral.sh/uv/install.sh | sh
-ENV PATH="/root/.local/bin:${PATH}"
+# install uv and make it globally available
+RUN curl -LsSf https://astral.sh/uv/install.sh | sh && \
+    mv /root/.local/bin/uv /usr/local/bin/uv
 
-# 👇 safer cache location inside the app folder
-ENV UV_CACHE_DIR=/app/.uvcache
-RUN mkdir -p /app/.uvcache && chmod -R 777 /app/.uvcache
+# use HF persistent writable storage for uv cache
+ENV UV_CACHE_DIR=/data/uvcache
+
+# create a non-root user and give it ownership of /app and /data
+RUN useradd -m -u 1000 appuser && mkdir -p /app /data/uvcache && \
+    chown -R appuser:appuser /app /data
 
 WORKDIR /app
-COPY . .
 
-RUN uv sync --frozen
+# copy code as appuser so files are writable at runtime
+COPY --chown=appuser:appuser . /app
+
+USER appuser
+
+# install deps into project venv from uv.lock (fast/reproducible)
+RUN uv --version && uv sync --frozen
 
+# Spaces provides $PORT; default to 7860 for local runs
+ENV PORT=7860
 EXPOSE 7860
 
-# Respect Hugging Face's $PORT
-CMD ["uv", "run", "chainlit", "run", "src/study_chatbot/app.py", "--host", "0.0.0.0", "--port", "$PORT"]
+# start Chainlit
+CMD ["uv", "run", "chainlit", "run", "src/study_chatbot/app.py", "--host", "0.0.0.0", "--port", "${PORT}"]