usergroup

Dockerfile

@@ -2,21 +2,32 @@ FROM python:3.11-slim
 
 WORKDIR /app
 
+# Create a non-root user and group
+RUN groupadd -r appgroup && useradd -r -g appgroup -d /app -s /sbin/nologin -c "Docker image user" appuser
+
 # Install uv for faster package management
 RUN pip install uv
 
 # Set UV_CACHE_DIR to a writable location
 ENV UV_CACHE_DIR /app/.uv_cache
 
-# Copy requirements file
-COPY requirements.txt .
+# Copy requirements file first to leverage Docker cache
+COPY --chown=appuser:appgroup requirements.txt .
+
+# Create the cache directory and set permissions before switching user
+# This ensures the directory exists and is writable by appuser
+RUN mkdir -p /app/.uv_cache && chown -R appuser:appgroup /app/.uv_cache
+
+# Switch to the non-root user
+USER appuser
 
 # Install dependencies using uv
 RUN uv venv
 RUN uv pip install -r requirements.txt
 
 # Copy application code
-COPY server.py .
+# Ensure the appuser owns the application code as well
+COPY --chown=appuser:appgroup server.py .
 
 # Expose the port the server runs on
 EXPOSE 7860