Update Dockerfile

Dockerfile

@@ -1,38 +1,43 @@
 FROM python:3.9-slim
 
-# 1. Install system dependencies
+# Create a non-root user
+RUN useradd -m -u 1000 appuser
+
+# Install system dependencies
 RUN apt-get update && apt-get install -y \
     espeak-ng \
     git \
     libsndfile1 \
     curl
 
-# 2. Configure environment
+# Configure environment
 ENV PYTHONUNBUFFERED=1 \
-    HF_HOME=/app/cache \
+    HF_HOME=/home/appuser/cache \
     PYTHONPATH="/app"
 
-# 3. Create cache directory with permissions
-RUN mkdir -p /app/cache && \
-    chmod -R 777 /app/cache
+# Create necessary directories and set permissions
+RUN mkdir -p /app /home/appuser/cache /home/appuser/.local /home/appuser/.config/pulse && \
+    chown -R appuser:appuser /app /home/appuser/cache /home/appuser/.local /home/appuser/.config && \
+    chmod -R 755 /app /home/appuser/cache /home/appuser/.local /home/appuser/.config
 
 WORKDIR /app
 
-# 4. Install Python dependencies
+# Copy requirements first for better caching
 COPY requirements.txt .
+RUN chown appuser:appuser requirements.txt
 
-RUN pip install --upgrade pip setuptools wheel && \
-    pip install --no-cache-dir -r requirements.txt
+# Switch to non-root user
+USER appuser
 
-# 5. Install misaki from source (with data files)
-RUN pip install git+https://github.com/hexgrad/misaki.git --no-cache-dir
+# Install Python dependencies
+RUN pip install --user --upgrade pip setuptools wheel && \
+    pip install --user --no-cache-dir -r requirements.txt
 
-# 6. Fix PulseAudio warnings
-RUN mkdir -p /.config/pulse && \
-    chmod -R 777 /.config
+# Install misaki from source (with data files)
+RUN pip install --user git+https://github.com/hexgrad/misaki.git --no-cache-dir
 
-# 7. Copy application code
-COPY . .
+# Copy application code
+COPY --chown=appuser:appuser . .
 
-# 8. Run FastAPI
-CMD uvicorn app:app --host 0.0.0.0 --port 7860
+# Run FastAPI
+CMD ["python", "-m", "uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860"]