ai: Switch to production-ready Docker setup.

Dockerfile

@@ -1,27 +1,48 @@
-# Use the latest personal Ubuntu image as the starting point
-FROM hadadrjt/ubuntu:latest
+#
+# SPDX-FileCopyrightText: Hadad <[email protected]>
+# SPDX-License-Identifier: Apache-2.0
+#
 
-# Set the user to root to have full permissions during build and runtime
-USER root
+# Use the latest version of Ubuntu image from the specified
+# Docker Hub repository, as the base image for this container.
+FROM hadadrjt/ubuntu:latest
 
-# Set the working directory inside the container to /usr/src/app
-# All subsequent commands will be run in this directory
+# Set the working directory inside the container to /usr/src/app.
+# All subsequent instructions will operate from this path.
 WORKDIR /usr/src/app
 
-# Copy all files from the current directory on the host machine to the working directory in the container
+# Copy all files and directories from the build context on the
+# host machine into the working directory in the container.
 COPY . .
 
-# Install Python dependencies listed in requirements.txt without using cache to reduce image size
+# Install all Python dependencies listed in requirements.txt.
+# The --no-cache-dir flag ensures that pip does not store the
+# downloaded packages, reducing image size.
 RUN pip install --no-cache-dir -r requirements.txt
 
-# Expose port 7860 so that it can be accessed from outside the container
+# Create a new user named 'app' for running the application in production.
+# Change ownership of the application directory to the 'app' user.
+# Lock the root account to prevent direct login for security reasons.
+# Change the root user's shell to nologin, further restricting access.
+RUN useradd -m app \
+    && chown -R app /usr/src/app \
+    && passwd -l root \
+    && usermod -s /usr/sbin/nologin root
+
+# Expose port to allow external access to the Gradio application.
 EXPOSE 7860
 
-# Set an environment variable to configure the Gradio server to listen on all network interfaces
+# Set an environment variable so Gradio listens on all network interfaces,
+# enabling external connections.
 ENV GRADIO_SERVER_NAME="0.0.0.0"
 
-# Clear any default entrypoint to allow CMD to run directly
+# Switch to the 'app' user for all subsequent instructions to
+# enhance security and prevent running as root.
+USER app
+
+# Remove any default entrypoint to ensure only the CMD instruction is
+# executed when the container starts.
 ENTRYPOINT []
 
-# Specify the default command to run the Python application when the container starts
+# Define the default command to start the application.
 CMD ["python", "app.py"]