Update Dockerfile

Dockerfile

@@ -1,7 +1,10 @@
 # -------- Base Python with libs Blender needs (CPU headless) --------
 FROM python:3.11-slim-bookworm
 
-ENV DEBIAN_FRONTEND=noninteractive
+ENV DEBIAN_FRONTEND=noninteractive \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1 \
+    HOME=/home/user
 
 # System deps for Blender GUI-less rendering + git + shell
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -9,7 +12,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libglib2.0-0 libx11-6 libxi6 libxxf86vm1 libxrender1 libxfixes3 \
     libxkbcommon0 libxrandr2 libasound2 libxinerama1 libsm6 libice6 \
     libgl1 libegl1 libglu1-mesa libdbus-1-3 libxcb1 \
- && rm -rf /var/lib/apt/lists/*
+ && rm -rf /var/lib/apt/lists/* && \
+    mkdir -p /home/user && chmod -R 755 /home/user
 
 # Local copy of model-viewer (avoid external loads at runtime)
 RUN mkdir -p /app/static && \
@@ -28,8 +32,8 @@ RUN wget -q https://download.blender.org/release/Blender${BLENDER_MAJOR}/blender
 RUN /opt/blender-${BLENDER_VERSION}-linux-x64/${BLENDER_MAJOR}/python/bin/python3.11 -m ensurepip && \
     /opt/blender-${BLENDER_VERSION}-linux-x64/${BLENDER_MAJOR}/python/bin/python3.11 -m pip install --no-cache-dir Pillow
 
-# -------- Runtime: fetch private repo, install, run app.py --------
-# Required in Space settings:
+# -------- Runtime: fetch private repo, create venv, install, run app.py --------
+# Space settings required:
 #   Secret:   GIT_TOKEN                         (PAT with repo read access)
 #   Variable: GIT_REPO                          (chaous/render OR https://github.com/chaous/render.git)
 #   Variable: GIT_REF       (optional, default "main")
@@ -41,6 +45,7 @@ RUN printf '%s\n' \
 '' \
 'export BLENDER_BIN="${BLENDER_BIN:-blender}"' \
 'TARGET_ROOT="${TARGET_ROOT:-/tmp/app}"' \
+'VENV_DIR="${VENV_DIR:-/tmp/venv}"' \
 'REPO="${GIT_REPO:-}"' \
 'REF="${GIT_REF:-main}"' \
 'SUBDIR="${GIT_SUBDIR:-}"' \
@@ -56,25 +61,19 @@ RUN printf '%s\n' \
 '  BASE_URL="https://github.com/${REPO}.git"' \
 'fi' \
 '' \
-'# Build auth URL (token in URL avoids interactive prompts). Use x-access-token as user.' \
+'# Build auth URL (token in URL prevents interactive prompts). Uses x-access-token as user.' \
 'if [[ "${BASE_URL}" == https://github.com/* ]]; then' \
 '  AUTH_URL="${BASE_URL/https:\/\//https:\/\/x-access-token:${GIT_TOKEN}@}"' \
 '  SAN_URL="${BASE_URL}"' \
 'else' \
-'  # Non-GitHub host: fall back to header-based clone' \
 '  AUTH_URL="${BASE_URL}"' \
 '  SAN_URL="${BASE_URL}"' \
 'fi' \
 '' \
 'echo "[info] Cloning ${SAN_URL}@${REF} into ${TARGET_ROOT}..."' \
-'rm -rf "${TARGET_ROOT}"' \
+'rm -rf "${TARGET_ROOT}" "${VENV_DIR}"' \
 'mkdir -p "${TARGET_ROOT}"' \
-'' \
-'if [[ "${BASE_URL}" == https://github.com/* ]]; then' \
-'  git clone --depth 1 --branch "${REF}" "${AUTH_URL}" "${TARGET_ROOT}"' \
-'else' \
-'  git -c http.extraHeader="Authorization: Bearer ${GIT_TOKEN}" clone --depth 1 --branch "${REF}" "${AUTH_URL}" "${TARGET_ROOT}"' \
-'fi' \
+'git clone --depth 1 --branch "${REF}" "${AUTH_URL}" "${TARGET_ROOT}"' \
 '' \
 'if [[ -n "${SUBDIR}" ]]; then' \
 '  if [[ -d "${TARGET_ROOT}/${SUBDIR}" ]]; then' \
@@ -87,9 +86,14 @@ RUN printf '%s\n' \
 '  cd "${TARGET_ROOT}"' \
 'fi' \
 '' \
+'echo "[info] Creating venv at ${VENV_DIR}..."' \
+'python -m venv "${VENV_DIR}"' \
+'source "${VENV_DIR}/bin/activate"' \
+'python -m pip install --upgrade pip' \
+'' \
 'if [[ -f requirements.txt ]]; then' \
 '  echo "[info] Installing repo requirements..."' \
-'  pip install --no-cache-dir -r requirements.txt' \
+'  pip install -r requirements.txt' \
 'fi' \
 '' \
 'if [[ ! -f app.py ]]; then' \
@@ -97,7 +101,7 @@ RUN printf '%s\n' \
 'fi' \
 '' \
 'echo "[info] Starting app.py..."' \
-'exec python app.py' \
+'exec "${VENV_DIR}/bin/python" app.py' \
 > /usr/local/bin/start.sh \
  && chmod +x /usr/local/bin/start.sh