Update Dockerfile

Dockerfile

@@ -1,76 +1,85 @@
-# Dockerfile for Spaces — creates writable .files and runs Chainlit
-# Uses python:3.11-slim as base. For GPU/CUDA, replace base image accordingly.
+# syntax=docker/dockerfile:1
+# Dockerfile for Hugging Face Spaces (Chainlit + Mini-Transformer)
 
 FROM python:3.11-slim
 
-ENV PYTHONUNBUFFERED=1
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PIP_NO_CACHE_DIR=1
+
 WORKDIR /home/user/app
 
-# Build args to optionally fetch a model from the Hugging Face Hub during image build.
-# WARNING: passing secrets (HF_MODEL_TOKEN) as build-args will leave them in image history.
+# Optional build args to fetch a HF model at build time
 ARG HF_MODEL_ID=""
 ARG HF_MODEL_NAME=""
 ARG HF_MODEL_REVISION=""
 ARG HF_MODEL_TOKEN=""
 ARG HF_MODEL_REPO_TYPE="model"
 
-# Create a non-root user (UID 1000) and home dir, then create .files with correct permissions.
-# Using a dedicated non-root user is a good practice for containerized Spaces.
+# Create non-root runtime user
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends build-essential git curl \
-    && rm -rf /var/lib/apt/lists/* \
-    && groupadd -g 1000 appuser || true \
-    && useradd -m -u 1000 -g appuser -s /bin/bash appuser || true
+ && apt-get install -y --no-install-recommends build-essential git curl \
+ && rm -rf /var/lib/apt/lists/* \
+ && groupadd -g 1000 appuser || true \
+ && useradd -m -u 1000 -g appuser -s /bin/bash appuser || true
 
-# Create app dir and .files, set ownership to appuser
+# Create runtime dirs now so Chainlit can write config/translations/files
 RUN mkdir -p /home/user/app/.files \
-    && mkdir -p /home/user/app/.cache /home/user/app/.local /home/user/app/logs \
-    && chown -R appuser:appuser /home/user/app \
-    && chmod -R 700 /home/user/app/.files
+    /home/user/app/.cache \
+    /home/user/app/.config \
+    /home/user/app/.local/share \
+    /home/user/app/logs \
+    /home/user/app/trained_models \
+    /home/user/app/.chainlit/translations
 
-# Copy project files as root, then install deps as root
-COPY . /home/user/app
+# Copy source with correct ownership (critical fix for your PermissionError)
+COPY --chown=appuser:appuser . /home/user/app
 
-# Use a requirements.txt if present; otherwise install package with [server] extras
+# Install deps
 RUN python -m pip install --upgrade pip setuptools wheel
-RUN if [ -f /home/user/app/requirements.txt ]; then \
+RUN if [ -f /home/user/app/req.txt ]; then \
+      pip install -r /home/user/app/req.txt; \
+      pip install -e .[server]; \
+    elif [ -f /home/user/app/requirements.txt ]; then \
       pip install -r /home/user/app/requirements.txt; \
-      pip install -e .[server];\
+      pip install -e .[server]; \
     else \
-      # Install the project in editable mode so sources are available at runtime
       pip install -e .[server]; \
     fi
 
-# Optionally fetch a model from the Hugging Face Hub at build time. This is only
-# executed when HF_MODEL_ID is provided as a build-arg. The downloaded model will
-# be placed under /home/user/app/trained_models so it's baked into the image.
-RUN mkdir -p /home/user/app/trained_models \
- && if [ -n "${HF_MODEL_ID}" ]; then \
-      echo "Fetching model ${HF_MODEL_ID} into /home/user/app/trained_models"; \
-      mini-transformer-fetch "${HF_MODEL_ID}" --name "${HF_MODEL_NAME:-}" --revision "${HF_MODEL_REVISION:-}" --token "${HF_MODEL_TOKEN:-}" --repo-type "${HF_MODEL_REPO_TYPE:-model}" --model-root /home/user/app/trained_models --force; \
+# Optional model download from HF Hub
+RUN if [ -n "${HF_MODEL_ID}" ]; then \
+      set -- mini-transformer-fetch "${HF_MODEL_ID}" \
+             --repo-type "${HF_MODEL_REPO_TYPE}" \
+             --model-root /home/user/app/trained_models \
+             --force; \
+      if [ -n "${HF_MODEL_NAME}" ]; then set -- "$@" --name "${HF_MODEL_NAME}"; fi; \
+      if [ -n "${HF_MODEL_REVISION}" ]; then set -- "$@" --revision "${HF_MODEL_REVISION}"; fi; \
+      if [ -n "${HF_MODEL_TOKEN}" ]; then set -- "$@" --token "${HF_MODEL_TOKEN}"; fi; \
+      "$@"; \
     else \
       echo "No HF_MODEL_ID provided; skipping model download"; \
     fi
 
-# If the project provides Makefile targets to fetch small/test models, run them now
-# so the models are present in the image before switching to the non-root user.
-RUN if [ -f /home/user/app/Makefile ]; then \
-      echo "Running make fetch-small and make fetch-test"; \
+# Optional fallback fetch via Makefile (only when HF_MODEL_ID is not set)
+RUN if [ -f /home/user/app/Makefile ] && [ -z "${HF_MODEL_ID}" ]; then \
       cd /home/user/app && make fetch-small && make fetch-test; \
     else \
-      echo "No Makefile found; skipping 'make fetch-*'"; \
+      echo "Skipping make fetch-*"; \
     fi
 
-# Ensure trained_models is owned by appuser, then switch to non-root user
-RUN chown -R appuser:appuser /home/user/app/trained_models || true
+# Ensure all runtime-writable paths are owned by appuser
+RUN chown -R appuser:appuser /home/user/app \
+ && chmod 700 /home/user/app/.files
+
 USER appuser
-ENV HOME=/home/user/app
-ENV XDG_CACHE_HOME=/home/user/app/.cache
-ENV XDG_CONFIG_HOME=/home/user/app/.config
-ENV XDG_DATA_HOME=/home/user/app/.local/share
-ENV CHAINLIT_FILES_DIR=/home/user/app/.files
+ENV HOME=/home/user/app \
+    XDG_CACHE_HOME=/home/user/app/.cache \
+    XDG_CONFIG_HOME=/home/user/app/.config \
+    XDG_DATA_HOME=/home/user/app/.local/share \
+    CHAINLIT_APP_ROOT=/home/user/app \
+    CHAINLIT_FILES_DIR=/home/user/app/.files
 
 EXPOSE 7860
 
-# Default command: run Chainlit against the packaged chainlit_app.py
 CMD ["bash", "-lc", "chainlit run src/mini_transformer/apps/chainlit_app.py --host 0.0.0.0 --port ${PORT:-7860}"]