Refine Dockerfile for uv build and permission handling

Dockerfile

@@ -4,9 +4,10 @@ FROM python:3.11-slim
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     PYTHONFAULTHANDLER=1 \
-    HOME=/home/user \
-    PATH="/home/user/.local/bin:$PATH" \
-    PYTHONPATH="$HOME/app:$PYTHONPATH"
+    HOME_DIR=/home/user \
+    APP_DIR=/home/user/app \
+    PATH="/root/.local/bin:$PATH" \
+    PYTHONPATH="/home/user/app:$PYTHONPATH"
 
 # Add non-root user
 RUN useradd -m -u 1000 user
@@ -17,33 +18,35 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     && rm -rf /var/lib/apt/lists/*
 
-# Set working directory
-WORKDIR $HOME/app
+# Install uv (as root, it will go to /root/.local/bin)
+RUN curl -LsSf https://astral.sh/uv/install.sh | sh
 
-# Copy project files first (copy everything at once to avoid missing files)
-COPY --chown=user . .
+# Set working directory
+WORKDIR ${APP_DIR}
 
-# Install UV as root (required for system installation)
-RUN curl -LsSf https://astral.sh/uv/install.sh | sh && \
-    echo 'export PATH=/root/.local/bin:$PATH' >> /root/.bashrc
+# Copy all project files. Crucially, these are now owned by root by default
+# as we haven't switched user yet. This ensures setuptools (run by root's uv)
+# can read them and write build artifacts in this directory.
+COPY . ${APP_DIR}
 
-# Install dependencies using uv as root
-RUN /root/.local/bin/uv pip install -r requirements.txt
+# Install dependencies using uv (run as root, installing system-wide)
+# This will also build and install the local insightflow-ai package
+RUN uv pip install --system --no-cache .
 
-# Set permissions for the app directory
-RUN chown -R user:user $HOME/app
+# Now that installation is done, change ownership of the app directory to the non-root user
+RUN chown -R user:user ${APP_DIR}
 
-# Switch to non-root user for running the app
+# Switch to non-root user for subsequent operations and runtime
 USER user
 
-# Create any necessary runtime directories
-RUN mkdir -p exports
+# Create necessary runtime directories (as non-root user)
+RUN mkdir -p ${APP_DIR}/exports ${APP_DIR}/data_sources
 
-# Run data download script to initialize data sources
-RUN python download_data.py
+# Run data download script to initialize data sources (as non-root user)
+RUN python ${APP_DIR}/download_data.py
 
 # Expose the port the app runs on
-EXPOSE 7860 
+EXPOSE 7860
 
 # Run the app
 CMD ["chainlit", "run", "app.py", "--host", "0.0.0.0", "--port", "7860"]