Update Dockerfile

Dockerfile

@@ -1,32 +1,72 @@
+# --------------------
+# Base image & metadata
+# --------------------
 FROM python:3.10-slim
 
+LABEL maintainer="Your Name <[email protected]>" \
+      description="Streamlit app with spaCy, CPU-only, for Hugging Face Space"
+
+# --------------------
+# Environment variables
+# --------------------
 ENV PYTHONUNBUFFERED=1 \
     PIP_NO_CACHE_DIR=1 \
     PORT=7860 \
     HOME=/code \
     STREAMLIT_HOME=/code/.streamlit \
-    STREAMLIT_SERVER_PORT=7860 \
     STREAMLIT_SERVER_HEADLESS=true \
     STREAMLIT_SERVER_ENABLECORS=false \
-    STREAMLIT_SERVER_ENABLEWEBRTC=false
+    STREAMLIT_SERVER_ENABLEWEBRTC=false \
+    STREAMLIT_SERVER_PORT=7860
 
+# --------------------
+# Working directory
+# --------------------
 WORKDIR /code
 
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-    build-essential \
+# --------------------
+# System dependencies
+# --------------------
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends build-essential \
     && rm -rf /var/lib/apt/lists/*
 
+# --------------------
+# Python dependencies
+# --------------------
 COPY requirements.txt .
-RUN pip install --upgrade pip setuptools wheel && \
-    pip install -r requirements.txt
+RUN pip install --upgrade pip setuptools wheel \
+    && pip install -r requirements.txt
 
-# Install spaCy small model at build time
+# --------------------
+# spaCy English model
+# --------------------
 RUN python -m spacy download en_core_web_sm
 
+# --------------------
+# Copy application code
+# --------------------
 COPY . .
 
+# --------------------
+# Expose port
+# --------------------
 EXPOSE 7860
 
-CMD ["streamlit", "run", "app.py",
-     "--server.address=0.0.0.0", "--server.port=7860"]
+# --------------------
+# Create non-root user (optional but recommended)
+# --------------------
+ARG USER_UID=1000
+ARG USER_GID=1000
+
+RUN groupadd --gid "$USER_GID" appgroup \
+    && useradd --uid "$USER_UID" --gid appgroup --shell /bin/false --no-create-home appuser \
+    && chown -R appuser:appgroup /code
+
+USER appuser
+
+# --------------------
+# Entrypoint
+# --------------------
+ENTRYPOINT ["streamlit", "run", "app.py"]
+CMD ["--server.address=0.0.0.0", "--server.port=7860"]