Dockerfile

# ── STAGE 1: Build Frontend (Next.js Static Export) ──
FROM node:20-alpine AS builder
WORKDIR /app/frontend

# Copy dependencies definitions
COPY frontend/package*.json ./
RUN npm install

# Copy application source code (ARG busts cache so source changes always rebuild)
ARG CACHEBUST=1
COPY frontend/ ./

# Allocate sufficient heap limit for production bundle compilation
ENV NODE_OPTIONS="--max-old-space-size=2048"
RUN npm run build

# ── STAGE 2: Production Python Runtime Runner ──
FROM python:3.11-slim

# Create dedicated non-root user required by Hugging Face Spaces security policy
RUN useradd -m -u 1000 user
WORKDIR /app

# Install minimal OS build dependencies
RUN apt-get update && apt-get install -y \
    libgomp1 \
    gcc \
    g++ \
    make \
    python3-dev \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Install python dependencies as user
COPY --chown=user backend/requirements.txt ./
RUN pip install --no-cache-dir --upgrade pip \
 && pip install --no-cache-dir -r requirements.txt

# Copy backend python packages
COPY --chown=user backend/ ./

# Establish web serving static destination directory, model directory, and data directory
RUN mkdir -p /app/static /app/models /app/data && chown -R user:user /app/static /app/models /app/data
COPY --chown=user --from=builder /app/frontend/out /app/static

# Enforce secure runner execution ownership context
USER user
ENV TZ="Asia/Jakarta"
EXPOSE 7860

# Initiate robust application framework entrypoint
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860", "--workers", "1"]