Dockerfile

# Use an official Python runtime as a parent image
FROM python:3.10-slim

# Install system dependencies (poppler-utils and tesseract-ocr)
RUN apt-get update && apt-get install -y \
    poppler-utils \
    tesseract-ocr \
    libtesseract-dev \
    && rm -rf /var/lib/apt/lists/*

# Create a non-root user
RUN useradd -m appuser

# Set working directory
WORKDIR /app

# Copy requirements.txt and install Python dependencies
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Copy the app code and templates
COPY app.py .
COPY templates /app/templates/

# Switch to non-root user
USER appuser

EXPOSE 7860

ENV PYTHONUNBUFFERED=1
ENV FLASK_APP=app.py

# Gunicorn with increased timeout and gevent workers for better handling of I/O bound tasks (like network/file ops)
# Adjust workers based on your Space's CPU cores.
# Timeout is for a single request/response cycle. Streaming should keep this alive.
CMD ["gunicorn", "--bind", "0.0.0.0:7860", "--workers", "1", "--worker-class", "gevent", "--timeout", "300", "app:app"]