refactor(docker): switch to python:3.11-slim base, install neo4j via APT

Dockerfile

@@ -1,11 +1,19 @@
-FROM neo4j:5.18-community
+FROM python:3.11-slim
 
-USER root
+ENV DEBIAN_FRONTEND=noninteractive
 
 # System deps
 RUN apt-get update && apt-get install -y \
-    python3 python3-pip python3-venv \
-    curl ca-certificates supervisor git \
+    curl ca-certificates gnupg supervisor git wget \
+    && rm -rf /var/lib/apt/lists/*
+
+# Neo4j 5 from official APT repo
+RUN curl -fsSL https://debian.neo4j.com/neotechnology.gpg.key \
+        | gpg --dearmor -o /usr/share/keyrings/neo4j.gpg \
+    && echo "deb [signed-by=/usr/share/keyrings/neo4j.gpg] https://debian.neo4j.com stable 5" \
+        > /etc/apt/sources.list.d/neo4j.list \
+    && apt-get update \
+    && apt-get install -y neo4j \
     && rm -rf /var/lib/apt/lists/*
 
 # Node.js 20
@@ -17,15 +25,15 @@ WORKDIR /app
 
 # Python deps
 COPY requirements.txt /app/requirements.txt
-RUN pip3 install --no-cache-dir --upgrade pip && \
-    pip3 install --no-cache-dir -r /app/requirements.txt
+RUN pip install --no-cache-dir --upgrade pip \
+    && pip install --no-cache-dir -r /app/requirements.txt
 
 # Frontend build
 COPY frontend /app/frontend
 WORKDIR /app/frontend
 RUN npm install && npm run build
 
-# Backend
+# Backend + data
 WORKDIR /app
 COPY backend /app/backend
 COPY data /app/data
@@ -33,12 +41,8 @@ COPY supervisord.conf /etc/supervisor/conf.d/ccrag.conf
 COPY start.sh /app/start.sh
 RUN chmod +x /app/start.sh
 
-# Write neo4j.conf directly — bypasses entrypoint /data permission check entirely.
-# Directories point to /tmp/neo4j which any user can write.
-RUN mkdir -p /var/lib/neo4j/conf /tmp/neo4j/data /tmp/neo4j/logs \
-        /tmp/neo4j/import /tmp/neo4j/plugins \
-    && chmod -R 777 /tmp/neo4j \
-    && printf '%s\n' \
+# Write neo4j.conf — point all dirs to /tmp, disable auth
+RUN printf '%s\n' \
         'dbms.security.auth_enabled=false' \
         'server.bolt.listen_address=127.0.0.1:7687' \
         'server.http.listen_address=127.0.0.1:7474' \
@@ -49,13 +53,13 @@ RUN mkdir -p /var/lib/neo4j/conf /tmp/neo4j/data /tmp/neo4j/logs \
         'server.memory.heap.initial_size=256m' \
         'server.memory.heap.max_size=512m' \
         'server.memory.pagecache.size=256m' \
-       > /var/lib/neo4j/conf/neo4j.conf \
-    && chmod 666 /var/lib/neo4j/conf/neo4j.conf
+    > /etc/neo4j/neo4j.conf
 
-# Override parent ENTRYPOINT — prevents /data writability check on container start
-ENTRYPOINT []
+# Pre-create Neo4j data dirs owned by neo4j user
+RUN mkdir -p /tmp/neo4j/data /tmp/neo4j/logs /tmp/neo4j/import /tmp/neo4j/plugins \
+    && chown -R neo4j:neo4j /tmp/neo4j \
+    && chmod -R 755 /tmp/neo4j
 
-# App config
 ENV OPENAI_MODEL=gpt-4o-mini
 ENV NEO4J_URI=bolt://localhost:7687
 ENV NEO4J_USER=neo4j

start.sh

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 set -e
 
-# Recreate Neo4j tmp dirs in case they were cleared at runtime
+# Recreate Neo4j data dirs and ensure neo4j user can write
 mkdir -p /tmp/neo4j/data /tmp/neo4j/logs /tmp/neo4j/import /tmp/neo4j/plugins
-chmod -R 777 /tmp/neo4j
+chown -R neo4j:neo4j /tmp/neo4j 2>/dev/null || chmod -R 777 /tmp/neo4j
 
 exec /usr/bin/supervisord -c /etc/supervisor/conf.d/ccrag.conf

supervisord.conf

@@ -1,12 +1,13 @@
 [supervisord]
 nodaemon=true
+user=root
 pidfile=/tmp/supervisord.pid
 logfile=/tmp/supervisord.log
 logfile_maxbytes=10MB
 loglevel=info
 
 [program:neo4j]
-command=/var/lib/neo4j/bin/neo4j console
+command=/usr/bin/neo4j console
 autostart=true
 autorestart=true
 stdout_logfile=/tmp/neo4j.log