incorporated feedback from @moser

WORKDIR /app

EXPOSE 5000

ARG USERNAME="portaluser"

# First, copy and install only the requirements...

RUN useradd -ms /bin/bash python && chown -R python:python /app

USER python

ENV PATH="$PATH:/home/python/.local/bin"

RUN useradd -ms /bin/bash ${USERNAME} && chown -R ${USERNAME}:${USERNAME} /app

USER ${USERNAME}

# The modified PATH is needed so that the pipenv executaable is found.

ENV PATH="$PATH:/home/${USERNAME}/.local/bin"

RUN pip install --upgrade pip setuptools

RUN pip install pipenv

COPY Pipfile.lock .

RUN pip install -r requirements.txt

# ... then the rest of the application. This allows the installation stage to be cached most of the time

# (so we don't have reinstall of all dependencies every time the container is rebuilt)

COPY --chown=python:python . .

COPY --chown=${USERNAME}:${USERNAME} . .

FROM base AS dev

ENV SERVER_TYPE=flask