Dockerfile

# Dockerfile
# Pinned base image for reproducible builds
FROM python:3.10.14-slim

# System dependencies — reduced attack surface
RUN apt-get update && \
    apt-get install -y --no-install-recommends git build-essential curl ca-certificates && \
    curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
    apt-get install -y --no-install-recommends nodejs && \
    rm -rf /var/lib/apt/lists/*

# Fix Node user collision and create standard Hugging Face user (UID 1000)
RUN userdel -r node || true && \
    useradd -m -u 1000 rhodawk

# Create target directories as root, then assign ownership
RUN mkdir -p /data /app && chown -R rhodawk /data /app

WORKDIR /app

# ============================================================
# CRITICAL FIX: Run global installations BEFORE switching users
# ============================================================
# Install uv globally as root
RUN pip install --no-cache-dir uv

# Copy requirements and install system-wide using uv as root
COPY requirements.txt .
RUN uv pip install --system --no-cache -r requirements.txt

# Point HOME to the correct path and update PATH
ENV HOME=/home/rhodawk
ENV PATH=$HOME/.local/bin:$PATH

# Switch to the non-root user NOW that global dependencies are installed
USER rhodawk

# Copy remaining application files natively
COPY --chown=rhodawk mcp_config.json .
COPY --chown=rhodawk app.py .

EXPOSE 7860

# Liveness probe for orchestrator health
HEALTHCHECK --interval=30s --timeout=10s --start-period=90s --retries=3 \
    CMD curl -f http://localhost:7860/ || exit 1

# Unbuffered execution so logs stream instantly to the console
CMD ["python", "-u", "app.py"]