debug

Dockerfile

@@ -1,34 +1,57 @@
 # Use an official Python runtime as a parent image
 FROM python:3.10-slim
 
-# Set the working directory in the container
+# Define arguments for user/group IDs (optional, but good practice)
+ARG USER_ID=1001
+ARG GROUP_ID=1001
+
+# Create a non-root user and group
+# Use standard IDs > 1000. Don't use 'node' or common names if not applicable.
+RUN groupadd --system --gid ${GROUP_ID} appgroup && \
+    useradd --system --uid ${USER_ID} --gid appgroup --shell /sbin/nologin --create-home appuser
+
+# Set the working directory
 WORKDIR /app
 
-# Copy the requirements file into the container at /app
+# Create essential directories and set ownership *before* copying files
+# DuckDB UI often uses ~/.duckdb (which will be /home/appuser/.duckdb)
+# Ensure these are owned by the user *before* VOLUME instruction
+RUN mkdir -p /app/data /home/appuser/.duckdb && \
+    chown -R ${USER_ID}:${GROUP_ID} /app /home/appuser/.duckdb
+
+# Switch context to the non-root user early for subsequent RUN/COPY commands
+USER appuser
+
+# Copy requirements file (as appuser)
 COPY requirements.txt .
 
-# Install any needed packages specified in requirements.txt
-RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir -r requirements.txt
+# Install dependencies (as appuser)
+# This also ensures packages are installed in a user-context if applicable
+RUN pip install --no-cache-dir --user --upgrade pip && \
+    pip install --no-cache-dir --user -r requirements.txt
 
-# Copy the rest of the application code into the container at /app
+# Copy application code (as appuser)
 COPY main.py .
 
 # --- Define Volumes ---
+# These paths MUST match the directories the 'appuser' process will write to.
+# Note: We created and chowned these earlier.
 VOLUME /app/data
-VOLUME /root/.duckdb
+VOLUME /home/appuser/.duckdb
 # --- End Define Volumes ---
 
-# Make API port 8000 available
+# Expose ports
 EXPOSE 8000
-# Make DuckDB UI port 8080 available (default)
 EXPOSE 8080
 
 # Define environment variables
 ENV PYTHONUNBUFFERED=1
 ENV UI_EXPECTED_PORT=8080
-
-# Command to run the application using Uvicorn
-# Use sh -c to execute commands before starting uvicorn
-# Explicitly set permissions on volume mount points just before app start
-CMD ["sh", "-c", "chmod 777 /app/data /root/.duckdb && exec uvicorn main:app --host 0.0.0.0 --port 8000"]
+# Ensure Python user packages are in the path
+ENV PATH="/home/appuser/.local/bin:${PATH}"
+# Set HOME so things like ~/.duckdb resolve correctly
+ENV HOME=/home/appuser
+
+# Command to run the application (now runs as appuser)
+# No chmod needed here. Ownership was handled during build.
+CMD ["python", "-m", "uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]