Dockerfile

# Dockerfile
# Production-grade multi-stage container optimization layout for Hugging Face Spaces.
# Runs securely as a non-privileged system application node on port 7860.

FROM python:3.11-slim

# Enforce immediate output streaming to prevent buffered log frames from dropping out
ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONPATH=/app/python-services

# Install system dependencies and clean up caches to keep build sizes lightweight
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Instantiate non-privileged runtime user account matching standard HF Space execution flags
RUN useradd -m -u 1000 appuser

WORKDIR /app

# Leverage Docker cache layers by copying only requirements initially
COPY python-services/requirements.txt ./requirements.txt

RUN pip install --no-cache-dir --upgrade pip && \
    pip install --no-cache-dir -r requirements.txt

# Copy the remaining service code files into the container
COPY python-services/ ./python-services/

# Fix system storage ownership permissions explicitly before changing users
RUN chown -R appuser:appuser /app

# Switch workspace directory down to the module base for standard runtime target mapping
WORKDIR /app/python-services
USER appuser

# Hugging Face Spaces expects application traffic directly routed to port 7860
EXPOSE 7860

# Health check pipeline mapping onto the state-sweep endpoint we built into llm_server.py
HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
    CMD curl -f http://localhost:7860/health || exit 1

# Launch production server worker thread via Uvicorn ASGI platform loop
CMD ["uvicorn", "llm_server:app", \
     "--host", "0.0.0.0", \
     "--port", "7860", \
     "--workers", "1", \
     "--log-level", "info"]