Update Dockerfile

Dockerfile

@@ -6,6 +6,14 @@ FROM python:3.11-slim
 ENV PYTHONUNBUFFERED=1
 WORKDIR /home/user/app
 
+# Build args to optionally fetch a model from the Hugging Face Hub during image build.
+# WARNING: passing secrets (HF_MODEL_TOKEN) as build-args will leave them in image history.
+ARG HF_MODEL_ID=""
+ARG HF_MODEL_NAME=""
+ARG HF_MODEL_REVISION=""
+ARG HF_MODEL_TOKEN=""
+ARG HF_MODEL_REPO_TYPE="model"
+
 # Create a non-root user (UID 1000) and home dir, then create .files with correct permissions.
 # Using a dedicated non-root user is a good practice for containerized Spaces.
 RUN apt-get update \
@@ -32,7 +40,28 @@ RUN if [ -f /home/user/app/requirements.txt ]; then \
       pip install -e .[server]; \
     fi
 
-# Switch to non-root user
+# Optionally fetch a model from the Hugging Face Hub at build time. This is only
+# executed when HF_MODEL_ID is provided as a build-arg. The downloaded model will
+# be placed under /home/user/app/trained_models so it's baked into the image.
+RUN mkdir -p /home/user/app/trained_models \
+ && if [ -n "${HF_MODEL_ID}" ]; then \
+      echo "Fetching model ${HF_MODEL_ID} into /home/user/app/trained_models"; \
+      mini-transformer-fetch "${HF_MODEL_ID}" --name "${HF_MODEL_NAME:-}" --revision "${HF_MODEL_REVISION:-}" --token "${HF_MODEL_TOKEN:-}" --repo-type "${HF_MODEL_REPO_TYPE:-model}" --model-root /home/user/app/trained_models --force; \
+    else \
+      echo "No HF_MODEL_ID provided; skipping model download"; \
+    fi
+
+# If the project provides Makefile targets to fetch small/test models, run them now
+# so the models are present in the image before switching to the non-root user.
+RUN if [ -f /home/user/app/Makefile ]; then \
+      echo "Running make fetch-small and make fetch-test"; \
+      cd /home/user/app && make fetch-small && make fetch-test; \
+    else \
+      echo "No Makefile found; skipping 'make fetch-*'"; \
+    fi
+
+# Ensure trained_models is owned by appuser, then switch to non-root user
+RUN chown -R appuser:appuser /home/user/app/trained_models || true
 USER appuser
 ENV HOME=/home/user/app
 ENV XDG_CACHE_HOME=/home/user/app/.cache