refactor: remove Loki, Promtail, and Grafana services from Docker Compose files

rad/Dockerfile.prod

@@ -38,28 +38,31 @@ RUN mkdir -p /wheels \
     && /tmp/venvbuild/bin/pip wheel --wheel-dir=/wheels -r requirements.txt \
     && rm -rf /tmp/venvbuild
 
-# Create the final uv-managed venv and install from the cached wheels where
-# possible. Using `--no-index --find-links=/wheels` makes pip prefer the
-# prebuilt wheels, avoiding recompilation.
-RUN uv venv /opt/venv \
-    && export VIRTUAL_ENV=/opt/venv \
-    && export PATH="/opt/venv/bin:$PATH" \
+# Create non-root user before creating the venv so we can install as that
+# user and avoid expensive recursive `chown -R` operations on large paths.
+RUN useradd -m appuser
+
+# Create the final uv-managed venv inside the app user's home and install
+# from the cached wheels where possible. Running the venv creation and
+# installation as `appuser` ensures ownership is correct without a later
+# recursive chown.
+USER appuser
+RUN uv venv /home/appuser/.venv \
+    && export VIRTUAL_ENV=/home/appuser/.venv \
+    && export PATH="/home/appuser/.venv/bin:$PATH" \
     && uv pip install --upgrade pip setuptools wheel \
     && uv pip install --no-index --find-links=/wheels -r requirements.txt
 
 # Ensure the runtime environment uses the uv-managed venv by default.
-# This persists the venv into image ENV so `python` and `gunicorn` point
-# to the venv-installed binaries at container start.
-ENV VIRTUAL_ENV=/opt/venv
-ENV PATH="/opt/venv/bin:$PATH"
+ENV VIRTUAL_ENV=/home/appuser/.venv
+ENV PATH="/home/appuser/.venv/bin:$PATH"
 
-# Create non-root user before copying files so we can use Docker's
-# `--chown` flag during COPY and avoid an expensive recursive `chown -R`.
-RUN useradd -m appuser
+# Switch back to root to copy project files and prepare the log directory.
+USER root
 
 # Create directory for application logs and ensure ownership is correct.
-# Do this as root before switching to `appuser` so the directory exists
-# and can be mounted by the dev compose override.
+# Do this as root before switching to `appuser` so the directory exists and
+# can be mounted by the dev compose override.
 RUN mkdir -p /var/log/rad \
     && chown -R appuser:appuser /var/log/rad
 
@@ -67,10 +70,6 @@ RUN mkdir -p /var/log/rad \
 # a separate `chown -R` step). This keeps layer reuse efficient.
 COPY --chown=appuser:appuser . /usr/src/app
 
-# Ensure the venv is usable by the non-root user; chown only the venv path
-# (much smaller than the whole project tree) to avoid a long recursive chown.
-RUN chown -R appuser:appuser /opt/venv
-
 # Make the entrypoint executable (some files in the repo may not have the
 # executable bit set). Do this as root before switching to the app user.
 RUN [ -f /usr/src/app/entrypoint.sh ] && chmod +x /usr/src/app/entrypoint.sh || true