FROM python:3.9-slim WORKDIR /app # Install system dependencies RUN apt-get update && apt-get install -y \ build-essential \ && rm -rf /var/lib/apt/lists/* # Create directories with secure permissions RUN mkdir -p cache/huggingface vector_store chat_history \ && chown -R 1000:1000 . \ && chmod -R 755 . # Copy dependencies separately for caching COPY requirements.txt . # Install Python dependencies RUN pip install --no-cache-dir -r requirements.txt # Copy source code COPY . . # Set environment variables ENV HF_HOME=/app/cache/huggingface ENV HUGGINGFACE_HUB_CACHE=/app/cache/huggingface ENV XDG_CACHE_HOME=/app/cache # Set permissions (only for newly created files) RUN chown -R 1000:1000 /app \ && find /app -type d -exec chmod 755 {} \; \ && find /app -type f -exec chmod 644 {} \; # Run as non-privileged user USER 1000 EXPOSE 8000 CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "8000"]