more docker updates

rad/Dockerfile.prod

@@ -29,17 +29,45 @@ WORKDIR /usr/src/app
 
 # Install python deps into a uv-managed venv for reproducible builds
 COPY requirements.txt /usr/src/app/
+# Prebuild wheels into /wheels so compiled artifacts are cached in a layer.
+# This speeds rebuilds when `requirements.txt` hasn't changed. The first build
+# still needs to compile any packages without prebuilt wheels.
+RUN mkdir -p /wheels \
+    && python -m venv /tmp/venvbuild \
+    && /tmp/venvbuild/bin/pip install --upgrade pip setuptools wheel \
+    && /tmp/venvbuild/bin/pip wheel --wheel-dir=/wheels -r requirements.txt \
+    && rm -rf /tmp/venvbuild
+
+# Create the final uv-managed venv and install from the cached wheels where
+# possible. Using `--no-index --find-links=/wheels` makes pip prefer the
+# prebuilt wheels, avoiding recompilation.
 RUN uv venv /opt/venv \
     && export VIRTUAL_ENV=/opt/venv \
     && export PATH="/opt/venv/bin:$PATH" \
     && uv pip install --upgrade pip setuptools wheel \
-    && uv pip install --no-cache-dir -r requirements.txt
+    && uv pip install --no-index --find-links=/wheels -r requirements.txt
 
-# Copy project files into image
-COPY . /usr/src/app
+# Ensure the runtime environment uses the uv-managed venv by default.
+# This persists the venv into image ENV so `python` and `gunicorn` point
+# to the venv-installed binaries at container start.
+ENV VIRTUAL_ENV=/opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
 
-# Create non-root user
-RUN useradd -m appuser && chown -R appuser /usr/src/app /opt/venv
+# Create non-root user before copying files so we can use Docker's
+# `--chown` flag during COPY and avoid an expensive recursive `chown -R`.
+RUN useradd -m appuser
+
+# Copy project files into image and set ownership during copy (faster than
+# a separate `chown -R` step). This keeps layer reuse efficient.
+COPY --chown=appuser:appuser . /usr/src/app
+
+# Ensure the venv is usable by the non-root user; chown only the venv path
+# (much smaller than the whole project tree) to avoid a long recursive chown.
+RUN chown -R appuser:appuser /opt/venv
+
+# Make the entrypoint executable (some files in the repo may not have the
+# executable bit set). Do this as root before switching to the app user.
+RUN [ -f /usr/src/app/entrypoint.sh ] && chmod +x /usr/src/app/entrypoint.sh || true
 USER appuser
 
 ENTRYPOINT ["/usr/src/app/entrypoint.sh"]