In the lines below, there is a volume mount to ~/.aws/ on the host machine, which is the standard location for AWS credentials:

    volumes:
      - ./model:/app
      - /app/.venv # do not clobber installed venv
      - ~/.aws/:/root/.aws:ro

This is problematic, because:

• it assumes that the host machine has credentials stored there
• it assumes that developers would want to use their standard set of AWS credentials, rather than app-specific IAM credentials to work with Caddy (i.e. for least privilege adherence, or cost tracking)
• the code in the container could get a much higher level of AWS access than it needs

It would be better to set this with environment variables specific to the Docker container.