Adding the new rewrite

Dockerfile

@@ -1,23 +1,48 @@
-FROM python:3.12-slim
+# syntax=docker/dockerfile:1.6
+FROM python:3.12.7-slim AS builder
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1
+
+WORKDIR /build
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends build-essential gcc \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY requirements.txt ./
+RUN pip install --upgrade pip && pip wheel --wheel-dir /wheels -r requirements.txt
+
+
+FROM python:3.12.7-slim AS runtime
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1 \
+    REDIS_URL=redis://redis:6379/0
 
 WORKDIR /app
 
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends \
-       build-essential \
-       apcupsd \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get install -y --no-install-recommends apcupsd curl \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd --system --gid 10001 appuser \
+    && useradd --system --uid 10001 --gid 10001 --home /app --shell /usr/sbin/nologin appuser
 
+COPY --from=builder /wheels /wheels
 COPY requirements.txt ./
-RUN pip install --no-cache-dir -r requirements.txt
+RUN pip install --no-index --find-links=/wheels -r requirements.txt \
+    && rm -rf /wheels
 
 COPY app ./app
 
+RUN chown -R appuser:appuser /app
+USER appuser
+
 EXPOSE 8000
 
-ENV REDIS_URL=redis://redis:6379/0
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+  CMD curl -fsS http://localhost:8000/healthz || exit 1
 
 CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]