Allow for read-only container run

* Requires adding tmpfs for writable paths
* uv run with --no-sync and --no-cache for read-only FS
* Docker compose updated for read-only mode matching expected k8s usage

Author: gcarothers

Dockerfile

@@ -38,4 +38,4 @@ RUN uv sync --frozen
 
 EXPOSE 10011
 
-ENTRYPOINT ["uv", "run", "uvicorn", "--host", "0.0.0.0", "--port", "10011", "--factory", "lexmachina_agent.server:app"]
+ENTRYPOINT ["uv", "run", "--no-sync", "--no-cache", "uvicorn", "--host", "0.0.0.0", "--port", "10011", "--factory", "lexmachina_agent.server:app"]

docker-compose.yml

@@ -13,6 +13,9 @@ services:
     env_file:
       - .env  # Optional: load environment variables from .env file
     restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /tmp
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:10011/.well-known/agent-card.json"]
       interval: 30s