Dockerfile

FROM python:3.9-slim

# Create dedicated user with home directory
RUN useradd -m -u 1000 user

# Set Hugging Face cache to user's writable directory
ENV HF_HOME=/home/user/.cache/huggingface
ENV TRANSFORMERS_CACHE=/home/user/.cache/huggingface

# Create cache directory with proper permissions
RUN mkdir -p ${HF_HOME} && chown -R user:user /home/user

# Set working directory (app will live here)
WORKDIR /app

# Install dependencies as root
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt gunicorn

# Copy app files (maintain ownership)
COPY --chown=user:user . .

RUN rm -rf /root/.cache/pip


# Switch to non-root user
USER user


EXPOSE 7860
CMD ["gunicorn", "--workers", "1", "--timeout", "120", "--bind", "0.0.0.0:7860", "api:app"]