Dockerfile

# Use a slim Python 3.9 base image
FROM python:3.9-slim

# Prevent Python from writing .pyc files and buffer stdout/stderr
ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

# Create and switch to a non-root user
RUN groupadd --gid 1000 appuser \
 && useradd --uid 1000 --gid appuser --shell /bin/bash --create-home appuser

# Set HOME and working directory
ENV HOME=/home/appuser \
    WORKDIR=/app \
    # Point Streamlit at a config dir we control
    STREAMLIT_CONFIG_DIR=/home/appuser/.streamlit

WORKDIR $WORKDIR

# Pre-create Streamlit config dir and write config.toml
RUN mkdir -p $STREAMLIT_CONFIG_DIR \
 && chown -R appuser:appuser $HOME \
 && printf "\
[server]\n\
enableCORS = false\n\
enableXsrfProtection = false\n\
" > $STREAMLIT_CONFIG_DIR/config.toml \
 && chown appuser:appuser $STREAMLIT_CONFIG_DIR/config.toml

# Copy requirements and install dependencies
COPY requirements.txt .
RUN pip install --upgrade pip \
 && pip install --no-cache-dir -r requirements.txt

# Copy application code & give ownership to appuser
COPY . $WORKDIR
RUN chown -R appuser:appuser $WORKDIR

# Switch to non-root user
USER appuser

# Expose Streamlit default port
EXPOSE 7860

# Launch the Streamlit app
CMD ["streamlit", "run", "app.py", \
     "--server.port=7860"]