Update Dockerfile

Dockerfile

@@ -3,13 +3,12 @@ FROM python:3.11-slim-bookworm
 
 ENV DEBIAN_FRONTEND=noninteractive
 
-# System deps for Blender GUI-less rendering
+# System deps for Blender GUI-less rendering + runtime fetch tools
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates wget bzip2 xz-utils \
+    ca-certificates wget curl bzip2 xz-utils rsync git \
     libglib2.0-0 libx11-6 libxi6 libxxf86vm1 libxrender1 libxfixes3 \
     libxkbcommon0 libxrandr2 libasound2 libxinerama1 libsm6 libice6 \
     libgl1 libegl1 libglu1-mesa libdbus-1-3 libxcb1 \
-    git curl \
  && rm -rf /var/lib/apt/lists/*
 
 # Grab a local copy of model-viewer so we can inline it (no external script loads)
@@ -38,13 +37,13 @@ RUN pip install --no-cache-dir -r requirements.txt
 COPY app.py render.py /app/
 
 # -------- Runtime bootstrap to pull private repo safely --------
-# Expects:
-#   - Secret:   GIT_TOKEN
-#   - Variable: GIT_REPO (e.g. owner/private-repo)
-#   - Variable: GIT_REF  (optional, default "main")
-#   - Variable: GIT_SUBDIR (optional, e.g. "apps/serviceA")
+# Expects Space settings:
+#   Secret:   GIT_TOKEN
+#   Variable: GIT_REPO   (e.g. owner/private-repo)
+#   Variable: GIT_REF    (optional, default "main")
+#   Variable: GIT_SUBDIR (optional, if app.py not at repo root)
 RUN set -eux; \
-  cat > /usr/local/bin/start.sh << 'EOF'; \
+  cat > /usr/local/bin/start.sh << 'EOF'
 #!/usr/bin/env bash
 set -euo pipefail
 
@@ -58,7 +57,7 @@ REF="${GIT_REF:-main}"
 SUBDIR="${GIT_SUBDIR:-}"
 
 use_bundled_fallback() {
-  echo "[info] Using bundled /app fallback (no private repo configured)."
+  echo "[info] Using bundled /app fallback (no private repo configured or fetch failed)."
   rsync -a /app/ "${TARGET_ROOT}/"
   cd "${TARGET_ROOT}"
   exec python app.py
@@ -71,8 +70,7 @@ fi
 echo "[info] Downloading ${REPO}@${REF} tarball from GitHub..."
 ARCHIVE_URL="https://api.github.com/repos/${REPO}/tarball/${REF}"
 
-# Download without leaking token into image layers (runtime only)
-# Token is passed in header; -q to avoid verbose logs
+# Download using header auth; avoid printing token
 if ! wget -q --header="Authorization: Bearer ${GIT_TOKEN}" -O /tmp/repo.tar.gz "${ARCHIVE_URL}"; then
   echo "[warn] Download failed; falling back to bundled app."
   use_bundled_fallback
@@ -83,15 +81,16 @@ rm -rf "${TARGET_ROOT:?}/"*
 tar -xzf /tmp/repo.tar.gz -C "${TARGET_ROOT}" --strip-components=1
 rm -f /tmp/repo.tar.gz
 
+# Optional subdir
 if [[ -n "${SUBDIR}" ]]; then
   if [[ -d "${TARGET_ROOT}/${SUBDIR}" ]]; then
     TARGET_ROOT="${TARGET_ROOT}/${SUBDIR}"
   else
-    echo "[warn] GIT_SUBDIR=${SUBDIR} not found in repo; continuing from repo root."
+    echo "[warn] GIT_SUBDIR='${SUBDIR}' not found; continuing from repo root."
   fi
 fi
 
-# If the repo ships its own requirements, install them now
+# Install repo-specific deps if present
 if [[ -f "${TARGET_ROOT}/requirements.txt" ]]; then
   echo "[info] Installing repo requirements..."
   pip install --no-cache-dir -r "${TARGET_ROOT}/requirements.txt"
@@ -99,7 +98,7 @@ fi
 
 cd "${TARGET_ROOT}"
 
-# Basic sanity check
+# Sanity check
 if [[ ! -f "app.py" ]]; then
   echo "[warn] app.py not found in repo path; falling back to bundled app."
   use_bundled_fallback