Update Dockerfile

Dockerfile

@@ -3,15 +3,15 @@ FROM python:3.11-slim-bookworm
 
 ENV DEBIAN_FRONTEND=noninteractive
 
-# System deps for Blender GUI-less rendering + runtime fetch tools
+# System deps for Blender GUI-less rendering + git + shell
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates wget curl bzip2 xz-utils git rsync bash \
+    ca-certificates wget curl bzip2 xz-utils git bash rsync \
     libglib2.0-0 libx11-6 libxi6 libxxf86vm1 libxrender1 libxfixes3 \
     libxkbcommon0 libxrandr2 libasound2 libxinerama1 libsm6 libice6 \
     libgl1 libegl1 libglu1-mesa libdbus-1-3 libxcb1 \
  && rm -rf /var/lib/apt/lists/*
 
-# Local copy of model-viewer (no external loads at runtime)
+# Local copy of model-viewer (avoid external loads at runtime)
 RUN mkdir -p /app/static && \
     wget -q -O /app/static/model-viewer.min.js \
       https://unpkg.com/@google/model-viewer/dist/model-viewer.min.js
@@ -24,80 +24,53 @@ RUN wget -q https://download.blender.org/release/Blender${BLENDER_MAJOR}/blender
  && rm blender-${BLENDER_VERSION}-linux-x64.tar.xz \
  && ln -s /opt/blender-${BLENDER_VERSION}-linux-x64/blender /usr/local/bin/blender
 
-# Pillow inside Blender's embedded Python
+# Pillow for Blender’s embedded Python (some scripts import PIL there)
 RUN /opt/blender-${BLENDER_VERSION}-linux-x64/${BLENDER_MAJOR}/python/bin/python3.11 -m ensurepip && \
     /opt/blender-${BLENDER_VERSION}-linux-x64/${BLENDER_MAJOR}/python/bin/python3.11 -m pip install --no-cache-dir Pillow
 
-# -------- Where the repo will live at runtime --------
-WORKDIR /srv/app
-
-# -------- Startup script: fetch private repo, install, run app.py --------
-# Space settings required:
-#   Secret:   GIT_TOKEN                       (PAT with repo read access)
-#   Variable: GIT_REPO                        (chaous/render OR https://github.com/chaous/render.git)
-#   Variable: GIT_REF      (optional, default "main")
-#   Variable: GIT_SUBDIR   (optional)
+# -------- Runtime: fetch private repo, install, run app.py --------
+# Required Space settings:
+#   Secret:   GIT_TOKEN                         (PAT with repo read access)
+#   Variable: GIT_REPO                          (chaous/render OR https://github.com/chaous/render.git)
+#   Variable: GIT_REF       (optional, default "main")
+#   Variable: GIT_SUBDIR    (optional, if app.py is not at repo root)
 RUN printf '%s\n' \
 '#!/usr/bin/env bash' \
 'set -euo pipefail' \
 'export GIT_TERMINAL_PROMPT=0' \
 '' \
 'export BLENDER_BIN="${BLENDER_BIN:-blender}"' \
-'TARGET_ROOT="/srv/app"' \
+'TARGET_ROOT="${TARGET_ROOT:-/tmp/app}"' \
 'REPO="${GIT_REPO:-}"' \
 'REF="${GIT_REF:-main}"' \
 'SUBDIR="${GIT_SUBDIR:-}"' \
-'UA="hf-space/1.0"' \
 '' \
 'if [[ -z "${REPO}" || -z "${GIT_TOKEN:-}" ]]; then' \
 '  echo "[error] GIT_REPO and GIT_TOKEN must be set." >&2; exit 1' \
 'fi' \
 '' \
-'fetch_tarball() {' \
-'  # Args: owner name ref' \
-'  local owner="$1"; local name="$2"; local ref="$3"' \
-'  echo "[info] Trying codeload tarball ${owner}/${name}@${ref}..."' \
-'  local url1="https://codeload.github.com/${owner}/${name}/tar.gz/${ref}"' \
-'  if curl -fsSL -H "Authorization: Bearer ${GIT_TOKEN}" -H "User-Agent: ${UA}" -o /tmp/repo.tar.gz "$url1"; then' \
-'    return 0; fi' \
-'  echo "[warn] codeload failed; trying API tarball..."' \
-'  local url2="https://api.github.com/repos/${owner}/${name}/tarball/${ref}"' \
-'  if curl -fsSL -H "Authorization: Bearer ${GIT_TOKEN}" -H "User-Agent: ${UA}" -H "X-GitHub-Api-Version: 2022-11-28" -o /tmp/repo.tar.gz "$url2"; then' \
-'    return 0; fi' \
-'  return 1' \
-'}' \
-'' \
-'echo "[info] Fetching ${REPO}@${REF}..."' \
+'# Normalize repo to a full HTTPS URL if needed' \
 'if [[ "${REPO}" == *"://"* ]]; then' \
-'  # URL form' \
-'  if [[ "${REPO}" == *"github.com"* ]]; then' \
-'    path="${REPO#*github.com/}"; path="${path%.git}"; owner="${path%%/*}"; name="${path#*/}"; name="${name%%/*}"' \
-'    if fetch_tarball "$owner" "$name" "$REF"; then' \
-'      rm -rf "${TARGET_ROOT:?}/"*; tar -xzf /tmp/repo.tar.gz -C "${TARGET_ROOT}" --strip-components=1; rm -f /tmp/repo.tar.gz' \
-'    else' \
-'      echo "[warn] Tarball failed; falling back to git clone..."' \
-'      rm -rf "${TARGET_ROOT:?}/"*' \
-'      git -c http.extraHeader="Authorization: Bearer ${GIT_TOKEN}" clone --depth 1 --branch "${REF}" "${REPO}" "${TARGET_ROOT}"' \
-'    fi' \
-'  else' \
-'    echo "[info] Non-GitHub host; using git clone."' \
-'    rm -rf "${TARGET_ROOT:?}/"*' \
-'    git -c http.extraHeader="Authorization: Bearer ${GIT_TOKEN}" clone --depth 1 --branch "${REF}" "${REPO}" "${TARGET_ROOT}"' \
-'  fi' \
+'  GIT_URL="${REPO}"' \
 'else' \
-'  # owner/repo form' \
-'  owner="${REPO%%/*}"; name="${REPO#*/}"' \
-'  if fetch_tarball "$owner" "$name" "$REF"; then' \
-'    rm -rf "${TARGET_ROOT:?}/"*; tar -xzf /tmp/repo.tar.gz -C "${TARGET_ROOT}" --strip-components=1; rm -f /tmp/repo.tar.gz' \
-'  else' \
-'    echo "[warn] Tarball failed; falling back to git clone..."' \
-'    rm -rf "${TARGET_ROOT:?}/"*' \
-'    git -c http.extraHeader="Authorization: Bearer ${GIT_TOKEN}" clone --depth 1 --branch "${REF}" "https://github.com/${owner}/${name}.git" "${TARGET_ROOT}"' \
-'  fi' \
+'  GIT_URL="https://github.com/${REPO}.git"' \
 'fi' \
 '' \
-'if [[ -n "${SUBDIR}" && -d "${TARGET_ROOT}/${SUBDIR}" ]]; then' \
-'  cd "${TARGET_ROOT}/${SUBDIR}"' \
+'echo "[info] Cloning ${GIT_URL}@${REF} into ${TARGET_ROOT}..."' \
+'rm -rf "${TARGET_ROOT}"' \
+'mkdir -p "${TARGET_ROOT}"' \
+'chmod -R 777 "${TARGET_ROOT}" || true' \
+'' \
+'# Use header auth (no token in URL or logs)' \
+'git -c http.extraHeader="Authorization: token ${GIT_TOKEN}" clone --depth 1 --branch "${REF}" "${GIT_URL}" "${TARGET_ROOT}"' \
+'' \
+'if [[ -n "${SUBDIR}" ]]; then' \
+'  if [[ -d "${TARGET_ROOT}/${SUBDIR}" ]]; then' \
+'    cd "${TARGET_ROOT}/${SUBDIR}"' \
+'  else' \
+'    echo "[warn] GIT_SUBDIR=${SUBDIR} not found; using repo root."' \
+'    cd "${TARGET_ROOT}"' \
+'  fi' \
 'else' \
 '  cd "${TARGET_ROOT}"' \
 'fi' \