Iot type and sparta

Dockerfile

@@ -21,18 +21,26 @@ RUN apt-get update \
 RUN useradd --create-home --shell /bin/bash appuser
 WORKDIR /app
 
-# Copy source code and offline knowledge base
+# ── Layer 1: Python dependencies (rebuilt only when requirements.txt changes) ──
+# Splitting deps from source code maximises Docker cache reuse on source-only
+# rebuilds, which is the most frequent case.
+COPY requirements.txt ./
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip install -r requirements.txt
+
+# ── Layer 2: embedding model (rebuilt only when sentence-transformers changes) ──
+RUN HF_HUB_DISABLE_SYMLINKS_WARNING=1 \
+    python -c "from sentence_transformers import SentenceTransformer; SentenceTransformer('all-MiniLM-L6-v2')"
+
+# ── Layer 3: source code (changes often — pip install --no-deps is near-instant) ──
 COPY --chown=appuser:appuser threat_analysis/ ./threat_analysis/
 COPY --chown=appuser:appuser config/ ./config/
 COPY --chown=appuser:appuser threatModel_Template/ ./threatModel_Template/
 COPY --chown=appuser:appuser pyproject.toml README.md LICENSE ./
 
-# Install as root (system-wide), make config.js writable by appuser,
-# then pre-download the embedding model so it's available offline.
-RUN pip install --no-cache-dir . && \
-    chown appuser:appuser /usr/local/lib/python3.10/site-packages/threat_analysis/server/static/js/config.js && \
-    HF_HUB_DISABLE_SYMLINKS_WARNING=1 \
-    python -c "from sentence_transformers import SentenceTransformer; SentenceTransformer('all-MiniLM-L6-v2')"
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip install --no-deps . && \
+    chown appuser:appuser /usr/local/lib/python3.10/site-packages/threat_analysis/server/static/js/config.js
 
 # Fixed vector store path — mountable via Docker named volume.
 # secopstm --init-rag and the RAG service both respect this env var.
@@ -41,6 +49,9 @@ ENV SECOPSTM_VECTOR_STORE_DIR=/app/rag/vector_store
 # Bind to all interfaces so the port is reachable from the Docker host
 ENV FLASK_HOST=0.0.0.0
 
+# Suppress LiteLLM warnings about AWS Bedrock/SageMaker (botocore not installed)
+ENV LITELLM_LOG=ERROR
+
 RUN mkdir -p /app/rag && chown appuser:appuser /app/rag
 
 USER appuser