Merge pull request #21 from xyvora/dockerfile

User non-root user in docker

backend/Dockerfile

@@ -4,7 +4,8 @@ WORKDIR /app
 
 ENV \
   PYTHONUNBUFFERED=true \
-  PATH=/root/.cargo/bin:$PATH
+  PATH=/root/.cargo/bin:$PATH \
+  UV_PYTHON_INSTALL_DIR=/opt/uv/python
 
 RUN : \
   && apt-get update \
@@ -28,32 +29,27 @@ RUN : \
 
 FROM ubuntu:24.04
 
-WORKDIR /app
+RUN useradd --create-home appuser
 
-RUN : \
-  && apt-get update \
-  && apt-get install -y --no-install-recommends \
-  curl \
-  ca-certificates \
-  && apt-get clean \
-  && rm -rf /var/lib/apt/lists/*
-
-ADD https://astral.sh/uv/install.sh /uv-installer.sh
+RUN mkdir -p /app && chown appuser:appuser /app
 
-RUN sh /uv-installer.sh && rm /uv-installer.sh
+WORKDIR /app
 
 ENV \
   PYTHONUNBUFFERED=true \
-  PATH="/root/.local/bin/:/app/.venv/bin:$PATH" \
+  PATH="/app/.venv/bin:$PATH" \
   WORKERS="1" \
   PORT="8000"
 
 COPY --from=builder /app/.venv /app/.venv
 COPY --from=builder /app/app /app/app
+COPY --from=builder /opt/uv/python /opt/uv/python
 COPY ./scripts/entrypoint.sh /app
 
 RUN chmod +x /app/entrypoint.sh
 
 EXPOSE 8000
 
+USER appuser
+
 ENTRYPOINT ["./entrypoint.sh"]

backend/scripts/entrypoint.sh

@@ -1,3 +1,3 @@
 #!/bin/bash
 
-exec uv run uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-8000} --workers ${WORKERS:-1}
+exec uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-8000} --workers ${WORKERS:-1}