Refactor Dockerfile comments and user setup

Updated Dockerfile comments for clarity and added home directory for non-root user.

Author: danielckv

Dockerfile

@@ -1,10 +1,11 @@
-# 1. PLATFORM PINNING
+# 1. PLATFORM PINNING: Essential for SAM 3 & CUDA wheels
 FROM --platform=linux/amd64 python:3.11-slim
 
 # 2. ENVIRONMENT VARIABLES
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     PIP_NO_CACHE_DIR=1 \
+    # Set CUDA Architectures for SAM 3 compilation
     TORCH_CUDA_ARCH_LIST="7.0;7.5;8.0;8.6;8.9;9.0"
 
 WORKDIR /app
@@ -15,12 +16,12 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     git \
     libgl1 \
     libglib2.0-0 \
-    # wget/curl often useful in notebooks
     wget \
     curl \
     && rm -rf /var/lib/apt/lists/*
 
 # 4. INSTALL PYTORCH (Heavy Layer)
+# We install this first to cache it effectively.
 RUN pip install --upgrade pip setuptools wheel && \
     pip install \
     torch==2.7.0 \
@@ -29,28 +30,28 @@ RUN pip install --upgrade pip setuptools wheel && \
     --index-url https://download.pytorch.org/whl/cu126
 
 # 5. CLONE SAM 3 & INSTALL JUPYTER
-# We install sam3 AND jupyterlab here
+# We clone sam3, install it in editable mode, and add JupyterLab.
 RUN git clone https://github.com/facebookresearch/sam3.git && \
     cd sam3 && \
     pip install -e . && \
     pip install jupyterlab matplotlib ipywidgets
 
-# 6. SECURITY: NON-ROOT USER
+# 6. SECURITY: NON-ROOT USER WITH HOME FIX
+# We explicitly set the home directory to /app so permissions work correctly.
 RUN addgroup --system --gid 1001 appgroup && \
-    adduser --system --uid 1001 --gid 1001 appuser
+    adduser --system --uid 1001 --gid 1001 --home /app appuser
 
-# Grant ownership so Jupyter can write notebooks to /app
+# Grant ownership of /app to the new user
 RUN chown -R appuser:appgroup /app
 
 # Switch to non-root user
 USER appuser
 
-# 7. CONFIGURATION
-# Expose the standard Jupyter port
+# 7. FINAL ENVIRONMENT SETUP
+# CRITICAL: This tells Python tools (Jupyter, HF, Matplotlib) that /app is the home dir.
+ENV HOME=/app
 EXPOSE 8888
 
 # 8. ENTRYPOINT
-# --ip=0.0.0.0: Allows connections from outside the container
-# --no-browser: Prevents it from trying to open a browser inside the container
-# --NotebookApp.token='': (Optional) Disables password for easier local dev
-CMD ["jupyter", "lab", "--ip=0.0.0.0", "--port=8888", "--no-browser", "--NotebookApp.token=''"]
+# Launches Jupyter Lab listening on all IPs, without a browser, and no token (for dev ease).
+CMD ["jupyter", "lab", "--ip=0.0.0.0", "--port=8888", "--no-browser", "--allow-root", "--NotebookApp.token=''"]