Update Dockerfile

Dockerfile

@@ -10,42 +10,44 @@ ENV TRANSFORMERS_CACHE=/app/.cache/huggingface
 ENV HF_HOME=/app/.cache/huggingface
 ENV MPLCONFIGDIR=/app/.cache/matplotlib
 
-RUN mkdir -p /app/.cache
+# Create cache directories and assign permissions
+RUN mkdir -p /app/.cache/huggingface /app/.cache/matplotlib
 
-# Adding permission for the cache
-RUN chmod -R 777 /app/.cache
-
-# Give write permissions to the /app directory
-RUN chmod -R 777 /app
-
-# Give write permissions to the /data directory
-#RUN chmod -R 777 /app/data
-
-# Create /app/logs directory and set permissions for logging
-RUN mkdir -p /app/logs && chmod -R 777 /app/logs
-
-# Set the working directory
-WORKDIR /app
-
-# Install system dependencies, including libgomp
+# Install system dependencies
 RUN apt-get update && apt-get install -y \
     libgl1-mesa-glx \
     libgomp1 \
     libglib2.0-0 \
     && rm -rf /var/lib/apt/lists/*
 
+# Create a non-root user and group
+RUN groupadd -r appgroup && useradd -r -g appgroup appuser
+
+# Create necessary directories
+RUN mkdir -p /app/flask_sessions /app/uploads /app/data /app/JSON /app/Models /app/logs /tmp/matplotlib /tmp/transformers_cache
+
+# Set permissions for app directories
+RUN chown -R appuser:appgroup /app /tmp/matplotlib /tmp/transformers_cache \
+    && chmod -R 755 /app /tmp/matplotlib /tmp/transformers_cache
+
+# Set working directory
+WORKDIR /app
+
 # Copy the requirements file into the container at /app
 COPY requirements.txt /app/
 
 # Install any needed packages specified in requirements.txt
 RUN pip install --no-cache-dir --upgrade -r requirements.txt
 
-# Create directories for session storage, uploads, and cache
-RUN mkdir -p /app/flask_sessions /app/uploads /app/data /app/JSON  /app/Models /tmp/matplotlib /tmp/transformers_cache && chmod -R 777 /app/flask_sessions /app/uploads /app/JSON /app/data /app/Models /tmp/matplotlib /tmp/transformers_cache
-
 # Copy the rest of the application code to /app
 COPY . /app/
 
+# Ensure app user owns the app directory
+RUN chown -R appuser:appgroup /app
+
+# Switch to non-root user
+USER appuser
+
 # Expose the port that the app runs on
 EXPOSE 7860