Dockerfile

FROM python:3.12-slim-bookworm

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    SDL_VIDEODRIVER=dummy \
    SDL_AUDIODRIVER=dummy \
    HOME=/home/user

RUN apt-get update && apt-get install -y --no-install-recommends \
      libsdl2-2.0-0 libgl1 libgomp1 libopenal1 libsndfile1 \
      libjpeg62-turbo libpng16-16 libxext6 ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && useradd --create-home --uid 1000 user

WORKDIR /app
COPY requirements.txt /app/requirements.txt
RUN pip install --no-cache-dir -r /app/requirements.txt
COPY --chown=user:user . /app
# ViZDoom writes _vizdoom/ and _vizdoom.ini into its current directory.
# WORKDIR is root-owned even when the copied files use --chown.
RUN chown user:user /app

USER user
EXPOSE 7860
CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860", "--workers", "1", "--no-access-log"]