Dockerfile

# Use an official Python runtime as a parent image
FROM python:3.10-slim

# Define arguments for user/group IDs (optional, but good practice)
ARG USER_ID=1001
ARG GROUP_ID=1001

# Create a non-root user and group
# Use standard IDs > 1000. Don't use 'node' or common names if not applicable.
RUN groupadd --system --gid ${GROUP_ID} appgroup && \
    useradd --system --uid ${USER_ID} --gid appgroup --shell /sbin/nologin --create-home appuser

# Set the working directory
WORKDIR /app

# Create essential directories and set ownership *before* copying files
# DuckDB UI often uses ~/.duckdb (which will be /home/appuser/.duckdb)
# Ensure these are owned by the user *before* VOLUME instruction
RUN mkdir -p /app/data /home/appuser/.duckdb && \
    chown -R ${USER_ID}:${GROUP_ID} /app /home/appuser/.duckdb

# Switch context to the non-root user early for subsequent RUN/COPY commands
USER appuser

# Copy requirements file (as appuser)
COPY requirements.txt .

# Install dependencies (as appuser)
# This also ensures packages are installed in a user-context if applicable
RUN pip install --no-cache-dir --user --upgrade pip && \
    pip install --no-cache-dir --user -r requirements.txt

# Copy application code (as appuser)
COPY main.py .

# --- Define Volumes ---
# These paths MUST match the directories the 'appuser' process will write to.
# Note: We created and chowned these earlier.
VOLUME /app/data
VOLUME /home/appuser/.duckdb
# --- End Define Volumes ---

# Expose ports
EXPOSE 8000
EXPOSE 8080

# Define environment variables
ENV PYTHONUNBUFFERED=1
ENV UI_EXPECTED_PORT=8080
# Ensure Python user packages are in the path
ENV PATH="/home/appuser/.local/bin:${PATH}"
# Set HOME so things like ~/.duckdb resolve correctly
ENV HOME=/home/appuser

# Command to run the application (now runs as appuser)
# No chmod needed here. Ownership was handled during build.
CMD ["python", "-m", "uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]