From 039ac6814f15779eb4bd17d430ee387301c0115e Mon Sep 17 00:00:00 2001
From: neptunehub <g.colangiuli@gmail.com>
Date: Tue, 25 Aug 2026 10:42:12 +0200
Subject: [PATCH] NON-ROOT image

---
 Dockerfile                 | 11 +++++++++++
 deployment/deployment.yaml |  8 ++------
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 41505fdc..3258edf7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -553,10 +553,21 @@ ENV ORT_DISABLE_MEMORY_PATTERN_OPTIMIZATION=1
 # Point numba to /tmp so it always has write access (issue: NeptuneHub/AudioMuse-AI#479).
 ENV NUMBA_CACHE_DIR=/tmp/numba_cache
 
+ENV PYTHONPYCACHEPREFIX=/tmp/pycache \
+    XDG_CACHE_HOME=/tmp/.cache \
+    CUPY_CACHE_DIR=/tmp/cupy_cache
+
 ENV PYTHONPATH=/usr/local/lib/python3/dist-packages:/app
 
+RUN getent passwd 1000 && getent group 1000 || { echo "ERROR: base image has no uid/gid 1000"; exit 1; }
+
+RUN mkdir -p /app/temp_audio /app/ivf_cache /app/backup /app/plugin/installed /workspace && \
+    chown -R 1000:1000 /app/temp_audio /app/ivf_cache /app/backup /app/plugin/installed /workspace && \
+    chown 1000:1000 /app/model
+
 EXPOSE 8000
 
 WORKDIR /workspace
+USER 1000:1000
 ENTRYPOINT ["/app/docker-entrypoint.sh"]
 CMD []
diff --git a/deployment/deployment.yaml b/deployment/deployment.yaml
index c921bbe3..fdb3a84f 100644
--- a/deployment/deployment.yaml
+++ b/deployment/deployment.yaml
@@ -147,9 +147,7 @@ spec:
         component: flask
     spec:
       securityContext:
-        runAsUser: 0 # Or a non-root user if your image supports it
-        runAsGroup: 0 # Added fsGroup for consistency if needed by volumes
-        fsGroup: 0
+        fsGroup: 1000
       containers:
       - name: flask-app
         image: ghcr.io/neptunehub/audiomuse-ai:latest # Your image from GHCR
@@ -283,9 +281,7 @@ spec:
         component: worker
     spec:
       securityContext:
-        runAsUser: 0
-        runAsGroup: 0
-        fsGroup: 0
+        fsGroup: 1000
       containers:
       - name: queue-worker
         image: ghcr.io/neptunehub/audiomuse-ai:latest # Your image from GHCR