From a68dbff48c28ac40369d6bfef5073ea9b42d35a6 Mon Sep 17 00:00:00 2001
From: Joltras <72395471+Joltras@users.noreply.github.com>
Date: Mon, 2 Nov 2026 11:59:23 +0000
Subject: [PATCH 1/4] chore: split runtime and dev dependencies

---
 .github/workflows/ci.yaml | 4 ++--
 requirements-dev.txt      | 7 +++++++
 requirements.txt          | 7 +------
 3 files changed, 10 insertions(+), 8 deletions(-)
 create mode 100644 requirements-dev.txt

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 791e3b2..ea2ed6e 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -18,7 +18,7 @@ jobs:
           python-version: "3.15"
 
       - name: Install dependencies
-        run: pip install -r requirements.txt
+        run: pip install -r requirements-dev.txt
 
       - name: Run tests
         run: pytest
@@ -34,7 +34,7 @@ jobs:
           python-version: "3.15"
 
       - name: Install dependencies
-        run: pip install -r requirements.txt
+        run: pip install -r requirements-dev.txt
 
       - name: Run pylint
         run: pylint src --rcfile=.pylintrc --fail-under=9.5
diff --git a/requirements-dev.txt b/requirements-dev.txt
new file mode 100644
index 0000000..b01515d
--- /dev/null
+++ b/requirements-dev.txt
@@ -0,0 +1,7 @@
+-r requirements.txt
+black~=26.10.1
+pylint~=4.1.3
+flake8~=7.5.0
+mypy~=2.4.0
+pytest~=9.1.1
+httpx~=0.28.1
diff --git a/requirements.txt b/requirements.txt
index f07b645..9220992 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,10 +1,5 @@
 numpy~=2.5.1
 fastapi~=0.162.0
 starlette~=1.10.0
-black~=26.10.1
-pylint~=4.1.3
-flake8~=7.5.0
-mypy~=2.4.0
 pillow~=13.0.0
-pytest~=9.1.1
-httpx~=0.28.1
\ No newline at end of file
+uvicorn~=0.54.0

From 6c883aadce321daf2c602032d327c4273fa4c4c1 Mon Sep 17 00:00:00 2001
From: Joltras <72395471+Joltras@users.noreply.github.com>
Date: Mon, 2 Nov 2026 11:59:31 +0000
Subject: [PATCH 2/4] chore: drop the separate starlette pin

---
 requirements.txt  | 1 -
 src/controller.py | 3 +--
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/requirements.txt b/requirements.txt
index 9220992..724aa97 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,5 +1,4 @@
 numpy~=2.5.1
 fastapi~=0.162.0
-starlette~=1.10.0
 pillow~=13.0.0
 uvicorn~=0.54.0
diff --git a/src/controller.py b/src/controller.py
index 6f4718f..1057e31 100644
--- a/src/controller.py
+++ b/src/controller.py
@@ -4,8 +4,7 @@
 
 import secrets
 
-from fastapi import FastAPI, Path
-from starlette.responses import Response
+from fastapi import FastAPI, Path, Response
 from fastapi.middleware.cors import CORSMiddleware
 
 from utils import globals as my_globals

From 761fef7105f51e5cb314560978b80f229cec5b74 Mon Sep 17 00:00:00 2001
From: Joltras <72395471+Joltras@users.noreply.github.com>
Date: Mon, 2 Nov 2026 12:00:19 +0000
Subject: [PATCH 3/4] chore(docker): slim down the image and run as non-root
 user

---
 .dockerignore |  9 +++++++++
 Dockerfile    | 27 ++++++++-------------------
 2 files changed, 17 insertions(+), 19 deletions(-)
 create mode 100644 .dockerignore

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..f4aaa14
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,9 @@
+.git
+.github
+.idea
+**/__pycache__
+**/.mypy_cache
+.pytest_cache
+.coverage
+generation
+test
diff --git a/Dockerfile b/Dockerfile
index 4edc851..67f1814 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,30 +1,19 @@
-# Use Python 3.11 as the base image
 FROM python:3.15-slim
 
-# Install Tkinter dependencies
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    python3-tk \
-    tk-dev \
-    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/*
-
-# Set the working directory
 WORKDIR /app
 
-# Copy requirements.txt first to leverage Docker cache
+# Install the runtime dependencies first to leverage the Docker cache
 COPY requirements.txt .
-
-# Install project dependencies
 RUN pip install --no-cache-dir -r requirements.txt
-RUN pip install --no-cache-dir uvicorn
 
-# Now copy **everything** from the project root into /app
-COPY . /app
+# The API only needs the source code
+COPY src ./src
+
+# Run the application as an unprivileged user
+RUN useradd --create-home --uid 1000 app
+USER app
 
 # Expose the port that FastAPI will run on
 EXPOSE 8000
 
-ENV PYTHONPATH=/app/src
-
-# Command to run the application
-CMD ["python", "-m", "uvicorn", "src.controller:app", "--host", "0.0.0.0", "--port", "8000"]
\ No newline at end of file
+CMD ["python", "-m", "uvicorn", "controller:app", "--app-dir", "src", "--host", "0.0.0.0", "--port", "8000"]

From 8c0efab32d79483692722737a5ebedc63df6074a Mon Sep 17 00:00:00 2001
From: Joltras <72395471+Joltras@users.noreply.github.com>
Date: Mon, 2 Nov 2026 12:00:25 +0000
Subject: [PATCH 4/4] chore: ignore coverage files

---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index 2ab8488..55fa8c7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@
 /generation
 __pycache__/
 .python-version
+.coverage