Update Dockerfile

Dockerfile

@@ -1,39 +1,54 @@
-# Dockerfile for Streamlit app in `src/` folder with Transformers cache fix
+# Dockerfile for Streamlit app in src/ folder with Transformers cache fix
 
 # 1. Base image
 FROM python:3.9-slim
 
-# 2. Set working directory
+# 2. Create non-root user for security
+RUN useradd -m -u 1000 appuser
+
+# 3. Set working directory
 WORKDIR /app
 
-# 3. Set HOME to /app to avoid writing to root
+# 4. Set HOME to /app to avoid writing to root
 ENV HOME=/app
 
-# 4. Environment variables for writable cache/config dirs
+# 5. Environment variables for writable cache/config dirs
 ENV STREAMLIT_CONFIG_DIR=/app/.streamlit \
     TRANSFORMERS_CACHE=/app/.cache/huggingface/hub \
     HF_HOME=/app/.cache/huggingface \
     XDG_CACHE_HOME=/app/.cache \
     STREAMLIT_HOME=/app/.cache/streamlit
 
-# 5. Create directories with correct permissions and inject Streamlit config
+# 6. Create cache directories with correct permissions
 RUN mkdir -p /app/.streamlit \
     && mkdir -p /app/.cache/huggingface/hub \
     && mkdir -p /app/.cache/streamlit \
-    && chmod -R 777 /app/.cache /app/.streamlit \
-    && printf '[browser]\ngatherUsageStats = false\n\n[server]\nheadless = true\nenableCORS = false\nport = 8501\n' > /app/.streamlit/config.toml
+    && chmod -R 755 /app/.cache /app/.streamlit \
+    && chown -R appuser:appuser /app
+
+# 7. Switch to non-root user
+USER appuser
 
-# 6. Copy in dependency file and install
+# 8. Copy in dependency file and install
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
-# 7. Copy your source app code
+# 9. Copy your source app code and Streamlit config
 COPY src/ ./src
 
-# 8. Expose Streamlit default port
+# 10. Move .streamlit/config.toml to the correct location
+RUN if [ -f /app/src/.streamlit/config.toml ]; then \
+        mv /app/src/.streamlit/config.toml /app/.streamlit/config.toml; \
+    fi
+
+# 11. Expose Streamlit default port
 EXPOSE 8501
 
-# 9. Launch Streamlit pointing to src/app.py
+# 12. Healthcheck to verify app is running
+HEALTHCHECK --interval=30s --timeout=3s \
+    CMD curl -f http://localhost:8501/healthz || exit 1
+
+# 13. Launch Streamlit pointing to src/app.py
 CMD ["streamlit", "run", "src/app.py", \
      "--server.port=8501", \
-     "--server.address=0.0.0.0"]
+     "--server.address=0.0.0.0"]