fix permission

Dockerfile

@@ -5,19 +5,16 @@ ENV PYTHONUNBUFFERED=1 \
     PYTHONDONTWRITEBYTECODE=1 \
     DEBIAN_FRONTEND=noninteractive \
     # Set cache directories to locations with write permissions
-    KAGGLE_CONFIG_DIR=/tmp/kaggle \
-    KAGGLEHUB_CACHE_FOLDER=/tmp/kagglehub \
-    MPLCONFIGDIR=/tmp/matplotlib \
-    TRANSFORMERS_CACHE=/tmp/transformers_cache \
-    HF_HOME=/tmp/huggingface \
-    XDG_CACHE_HOME=/tmp/xdg
+    KAGGLE_CONFIG_DIR=/app/.cache/kaggle \
+    KAGGLEHUB_CACHE_FOLDER=/app/.cache/kagglehub \
+    MPLCONFIGDIR=/app/.cache/matplotlib \
+    TRANSFORMERS_CACHE=/app/.cache/transformers \
+    HF_HOME=/app/.cache/huggingface \
+    XDG_CACHE_HOME=/app/.cache \
+    HOME=/app
 
 WORKDIR /app
 
-# Create necessary directories with appropriate permissions
-RUN mkdir -p /tmp/kaggle /tmp/kagglehub /tmp/matplotlib /tmp/transformers_cache /tmp/huggingface /tmp/xdg && \
-    chmod 777 /tmp/kaggle /tmp/kagglehub /tmp/matplotlib /tmp/transformers_cache /tmp/huggingface /tmp/xdg
-
 # Install system dependencies
 RUN apt-get update && apt-get install -y \
     build-essential \
@@ -36,6 +33,9 @@ RUN apt-get update && apt-get install -y \
     curl \
     && rm -rf /var/lib/apt/lists/*
 
+# Create a non-root user to run our application
+RUN groupadd -r appuser && useradd -r -g appuser -m -d /app appuser
+
 # Copy requirements first to leverage Docker cache
 COPY requirements.txt .
 
@@ -48,14 +48,17 @@ RUN pip install --no-cache-dir --upgrade pip && \
 # Copy the whole application
 COPY . .
 
-# Install and build star-vector if it exists
-# COPY star-vector/ ./star-vector/
-# RUN if [ -d "star-vector" ]; then cd star-vector && pip install -e . && cd ..; fi
+# Create cache directories and set proper ownership
+RUN mkdir -p /app/.cache/kaggle /app/.cache/kagglehub /app/.cache/matplotlib /app/.cache/transformers /app/.cache/huggingface && \
+    chown -R appuser:appuser /app
 
 # Set environment variables for GPU usage
 ENV NVIDIA_VISIBLE_DEVICES=all \
     NVIDIA_DRIVER_CAPABILITIES=compute,utility
 
+# Switch to non-root user
+USER appuser
+
 # Expose port for Streamlit
 EXPOSE 8501