Update Dockerfile

Dockerfile

@@ -1,5 +1,6 @@
 FROM python:3.13.5-slim
 
+# System setup
 WORKDIR /app
 
 RUN apt-get update && apt-get install -y \
@@ -8,22 +9,40 @@ RUN apt-get update && apt-get install -y \
     git \
  && rm -rf /var/lib/apt/lists/*
 
+# Install Python dependencies
 COPY requirements.txt ./
 RUN pip3 install --no-cache-dir -r requirements.txt
 
-# Ensure writable Streamlit paths and disable telemetry
-ENV STREAMLIT_HOME=/app/.streamlit \
+# Environment: ensure Streamlit writes under /app and disable telemetry
+ENV HOME=/app \
+    STREAMLIT_HOME=/app/.streamlit \
     STREAMLIT_CACHE_DIR=/app/.streamlit/cache \
     STREAMLIT_USER_PATH=/app/.streamlit \
     STREAMLIT_DISABLE_TELEMETRY=1 \
-    PYTHONUNBUFFERED=1
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1
 
-RUN mkdir -p /app/.streamlit/cache
+# Prepare writable directories
+RUN mkdir -p /app/.streamlit/cache \
+ && chmod -R 777 /app/.streamlit
 
+# Optionally create XDG dirs to be safe with other libs/tools
+ENV XDG_CONFIG_HOME=/app/.config \
+    XDG_CACHE_HOME=/app/.cache
+RUN mkdir -p /app/.config /app/.cache \
+ && chmod -R 777 /app/.config /app/.cache
+
+# Copy application code
 COPY src/ ./src/
 
-EXPOSE 8501
+# Create a non-root user and give ownership of /app
+RUN useradd -m -u 1000 appuser \
+ && chown -R appuser:appuser /app
+USER appuser
 
+# Networking and healthcheck
+EXPOSE 8501
 HEALTHCHECK CMD curl --fail http://localhost:8501/_stcore/health || exit 1
 
+# Run Streamlit app
 ENTRYPOINT ["streamlit", "run", "src/streamlit_app.py", "--server.port=8501", "--server.address=0.0.0.0"]