build(docker): appuser-owned data directories; note uv's index strategy for the docling file

A named volume mounted on /app/inputs, /app/indexes or /app/vectors inherits
the ownership of the image directory, so the image creates them as appuser;
before this the volume came up root-owned and every upload failed with a
permission error unless the container ran as root. docker-compose-standalone.yaml
still runs backend and worker as root, like docker-compose-hub.yaml, so it
also works with image tags that predate these directories.

requirements-docling.txt adds the PyTorch CPU index, which uv resolves only
with UV_INDEX_STRATEGY=unsafe-best-match (pip is unaffected); the file header
and the docs say so and point uv users at uv sync --extra docling.

application/Dockerfile

@@ -136,7 +136,10 @@ RUN if python -c "import docling" 2>/dev/null; then \
 
 COPY --chown=appuser:appuser . /app/application
 
-RUN mkdir -p /app/application/inputs/local
+# Runtime data directories, owned by the process user so a named volume
+# mounted on them (docker-compose-standalone.yaml) inherits that ownership
+# and uploads work without running the container as root.
+RUN mkdir -p /app/application/inputs/local /app/inputs /app/indexes /app/vectors
 
 ENV FLASK_APP=app.py
 

application/requirements-docling.txt

@@ -8,6 +8,10 @@
 # through application/parser/file/ocr_parser.py.
 # On Linux torch comes from the CPU-only PyTorch index (no CUDA stack); a GPU
 # deployment can reinstall torch from PyPI on top.
+# pip resolves the extra index as expected. uv only takes a package from the
+# first index that lists it, and the PyTorch index carries stale copies of
+# common packages, so with uv either run 'uv sync --extra docling' (the lock
+# pins the index per package) or set UV_INDEX_STRATEGY=unsafe-best-match.
 # Docker: --build-arg EXTRAS=docling
 
 --extra-index-url https://download.pytorch.org/whl/cpu