a ton of fun happened, refactored alot

Dockerfile

@@ -1,16 +1,32 @@
 FROM python:3.11-slim
 
+# Install build deps and netcat for the DB-wait
+RUN apt-get update && apt-get install -y \
+    gcc \
+    default-libmysqlclient-dev \
+    pkg-config \
+    netcat-openbsd \
+    curl \
+  && rm -rf /var/lib/apt/lists/*
+
+# Upgrade pip and install Python requirements
 WORKDIR /app
+COPY requirements.txt .
+RUN pip install --upgrade pip \
+ && pip install -r requirements.txt
+
+# Copy the app code
 COPY . .
 
-# Required for mysqlclient + netcat wait
-RUN apt-get update && apt-get install -y     gcc     default-libmysqlclient-dev     pkg-config     netcat-openbsd     curl  && rm -rf /var/lib/apt/lists/*
+# Create a non-root user and give it ownership of /app
+RUN useradd -ms /bin/bash appuser \
+ && chown -R appuser:appuser /app
 
-RUN pip install --upgrade pip
-RUN pip install -r requirements.txt
+# Switch to appuser for all subsequent commands
+USER appuser
 
-# Add entrypoint script
-COPY entrypoint.sh /entrypoint.sh
+# Make the entrypoint script executable
+COPY --chown=appuser:appuser entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 ENTRYPOINT ["/entrypoint.sh"]