upd dockerfile permission like developer of HF suggested

Dockerfile

@@ -1,39 +1,38 @@
-# Base image with Conda
+# 1. Base Image: Start with Miniconda as your project requires it.
 FROM continuumio/miniconda3
 
-# Set working directory
-WORKDIR /app
-
-# --- ADD THESE LINES HERE ---
-# Set environment variables to control cache locations
-# This prevents permission errors by directing cache writes to a local .cache
-# directory within our /app folder, which is always writable.
-ENV HF_HOME=/app/.cache/huggingface
-ENV MPLCONFIGDIR=/app/.cache/matplotlib
-# ---------------------------
-
-# Copy environment.yaml for conda
+# 2. Create Conda Environment:
+# First, copy only the environment file and create the environment.
+# This is done as root and caches this layer, so it only re-runs if environment.yaml changes.
 COPY environment.yaml /tmp/environment.yaml
-
-# Create the Conda environment
 RUN conda env create -f /tmp/environment.yaml
 
-# Set default shell to use conda env
-SHELL ["conda", "run", "--no-capture-output", "-n", "tirex", "/bin/bash", "-c"]
+# 3. Create a Non-Root User:
+# As shown in your example, we create a dedicated, non-root user to run the application.
+# This is a critical security and permissions best practice.
+RUN useradd -m -u 1000 user
 
-# Copy all project files and folders
-COPY app.py /app/
-COPY static /app/static
-COPY data /app/data
-COPY tirex /app/tirex
+# 4. Copy Application Code:
+# Copy the rest of your application code into the user's home directory.
+# The `--chown=user:user` flag sets the correct ownership at the same time,
+# which is more efficient and cleaner than a separate `chown` command.
+COPY --chown=user:user . /home/user/app
 
-# Change ownership of the /app directory to the container's non-root user.
-# This is crucial to allow the application to create cache files and directories.
-RUN chown -R 1000:1000 /app
+# 5. Switch to Non-Root User:
+# From this point on, all commands will be run as 'user'.
+USER user
 
+# 6. Set Working Directory:
+# Set the working directory to where the code was copied.
+WORKDIR /home/user/app
 
-# Expose the default port
+# 7. Expose Port:
+# Expose the port your Gradio app will run on.
 EXPOSE 7860
 
-# Run your app
-CMD ["conda", "run", "--no-capture-output", "-n", "tirex", "python", "app.py"]
+# 8. Run the Application:
+# Use the `conda run` command to execute your app within the 'tirex' environment.
+# Because we are now running as 'user', any libraries that need to write to a cache
+# (like Hugging Face, Matplotlib, or PyTorch) will do so inside `/home/user/.cache`,
+# which is writable by 'user', completely solving all previous permission errors.
+CMD ["conda", "run", "--no-capture-output", "-n", "tirex", "python", "app.py"]