From a3a05070e72cc446eebe56f5e37957a9f9e4c3ef Mon Sep 17 00:00:00 2001
From: Bryan Van Deusen <bryan.vandeusen@fabledsword.com>
Date: Wed, 18 Mar 2026 23:23:52 -0400
Subject: [PATCH] fix: upgrade pip, run as non-root user, remove stale
 FABLEDNETMON_CONFIG env

---
 Dockerfile | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 1490176..e163ef5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,11 @@
 FROM python:3.11-slim
 
-RUN apt-get update && apt-get install -y --no-install-recommends iputils-ping && rm -rf /var/lib/apt/lists/*
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends iputils-ping \
+    && rm -rf /var/lib/apt/lists/*
+
+# Upgrade pip to suppress the version notice
+RUN pip install --upgrade pip
 
 WORKDIR /app
 
@@ -10,10 +15,12 @@ RUN pip install --no-cache-dir .
 
 COPY alembic.ini .
 
-# Runtime directories
-RUN mkdir -p /data/playbook_cache /data/plugins
+# Runtime directories — owned by app user
+RUN useradd -m -u 1000 app \
+    && mkdir -p /data/playbook_cache /data/plugins \
+    && chown -R app:app /data /app
 
-ENV FABLEDNETMON_CONFIG=/config/config.yaml
+USER app
 
 EXPOSE 5000