Update Dockerfile (v2.1 production)

Dockerfile

@@ -1,18 +1,65 @@
-FROM python:3.11-slim
+# ─── Stage 1: Build frontend ─────────────────────────────────────────────────
+FROM node:20-alpine AS frontend-build
+
+WORKDIR /app/frontend
+
+# Install deps first for better layer caching
+COPY frontend/package*.json ./
+RUN npm ci --silent
+
+COPY frontend/ ./
+RUN npm run build
+
+# ─── Stage 2: Python runtime ─────────────────────────────────────────────────
+FROM python:3.11-slim AS runtime
+
+# Install curl (primary healthcheck tool) and keep the image lean
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends curl \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create non-root user early; home directory is created at /home/appuser
+RUN useradd --create-home appuser
 
 WORKDIR /app
 
+# Install Python dependencies as root (system-wide, before dropping privileges)
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
+# Copy application source
 COPY server.py .
-COPY frontend/ frontend/
 
-ENV BLITZKODE_HOST=0.0.0.0
-ENV BLITZKODE_PORT=7860
-ENV BLITZKODE_GPU_LAYERS=0
-ENV BLITZKODE_THREADS=4
+# Copy built frontend assets from stage 1
+COPY --from=frontend-build /app/frontend/dist ./frontend/dist
+
+# Create a zero-byte placeholder so Docker sees the expected mount path.
+# At runtime this file is replaced by the volume-mounted blitzkode.gguf.
+RUN touch /app/blitzkode.gguf \
+    && chown -R appuser:appuser /app
+
+# ─── Sensible runtime defaults ────────────────────────────────────────────────
+# All of these can be overridden at runtime via -e / docker-compose environment.
+ENV BLITZKODE_HOST=0.0.0.0 \
+    BLITZKODE_PORT=7860 \
+    BLITZKODE_MODEL_PATH=/app/blitzkode.gguf \
+    BLITZKODE_FRONTEND_PATH=/app/frontend/dist/index.html \
+    BLITZKODE_GPU_LAYERS=0 \
+    BLITZKODE_THREADS=4 \
+    BLITZKODE_PRELOAD_MODEL=true \
+    BLITZKODE_N_CTX=2048 \
+    BLITZKODE_BATCH=128
 
 EXPOSE 7860
 
+# Healthcheck: prefer curl (installed above); fall back to Python urllib so the
+# check still works if this image is rebuilt without the curl layer.
+HEALTHCHECK --interval=30s --timeout=10s --start-period=90s --retries=3 \
+    CMD curl -sf http://localhost:7860/health \
+        || python -c "import urllib.request; urllib.request.urlopen('http://localhost:7860/health')" \
+        || exit 1
+
+# Drop to non-root for the actual process
+USER appuser
+
 CMD ["python", "server.py"]