Dockerfile

# syntax=docker/dockerfile:1
# Dockerfile for Hugging Face Spaces (Chainlit + Mini-Transformer)

FROM python:3.11-slim

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PIP_NO_CACHE_DIR=1

WORKDIR /home/user/app

# Optional build args to fetch a HF model at build time
ARG HF_MODEL_ID=""
ARG HF_MODEL_NAME=""
ARG HF_MODEL_REVISION=""
ARG HF_MODEL_TOKEN=""
ARG HF_MODEL_REPO_TYPE="model"

# Create non-root runtime user
RUN apt-get update \
 && apt-get install -y --no-install-recommends build-essential git curl \
 && rm -rf /var/lib/apt/lists/* \
 && groupadd -g 1000 appuser || true \
 && useradd -m -u 1000 -g appuser -s /bin/bash appuser || true

# Create runtime dirs now so Chainlit can write config/translations/files
RUN mkdir -p /home/user/app/.files \
    /home/user/app/.cache \
    /home/user/app/.config \
    /home/user/app/.local/share \
    /home/user/app/logs \
    /home/user/app/trained_models \
    /home/user/app/.chainlit/translations

# Copy source with correct ownership (critical fix for your PermissionError)
COPY --chown=appuser:appuser . /home/user/app

# Install deps
RUN python -m pip install --upgrade pip setuptools wheel
RUN if [ -f /home/user/app/req.txt ]; then \
      pip install -r /home/user/app/req.txt; \
      pip install -e .[server]; \
    elif [ -f /home/user/app/requirements.txt ]; then \
      pip install -r /home/user/app/requirements.txt; \
      pip install -e .[server]; \
    else \
      pip install -e .[server]; \
    fi

# Optional model download from HF Hub
RUN if [ -n "${HF_MODEL_ID}" ]; then \
      set -- mini-transformer-fetch "${HF_MODEL_ID}" \
             --repo-type "${HF_MODEL_REPO_TYPE}" \
             --model-root /home/user/app/trained_models \
             --force; \
      if [ -n "${HF_MODEL_NAME}" ]; then set -- "$@" --name "${HF_MODEL_NAME}"; fi; \
      if [ -n "${HF_MODEL_REVISION}" ]; then set -- "$@" --revision "${HF_MODEL_REVISION}"; fi; \
      if [ -n "${HF_MODEL_TOKEN}" ]; then set -- "$@" --token "${HF_MODEL_TOKEN}"; fi; \
      "$@"; \
    else \
      echo "No HF_MODEL_ID provided; skipping model download"; \
    fi

# Optional fallback fetch via Makefile (only when HF_MODEL_ID is not set)
RUN if [ -f /home/user/app/Makefile ] && [ -z "${HF_MODEL_ID}" ]; then \
      cd /home/user/app && make fetch-small && make fetch-test; \
    else \
      echo "Skipping make fetch-*"; \
    fi

# Ensure all runtime-writable paths are owned by appuser
RUN chown -R appuser:appuser /home/user/app \
 && chmod 700 /home/user/app/.files

USER appuser
ENV HOME=/home/user/app \
    XDG_CACHE_HOME=/home/user/app/.cache \
    XDG_CONFIG_HOME=/home/user/app/.config \
    XDG_DATA_HOME=/home/user/app/.local/share \
    CHAINLIT_APP_ROOT=/home/user/app \
    CHAINLIT_FILES_DIR=/home/user/app/.files

EXPOSE 7860

CMD ["bash", "-lc", "chainlit run src/mini_transformer/apps/chainlit_app.py --host 0.0.0.0 --port ${PORT:-7860}"]