Update Dockerfile

Dockerfile

@@ -36,78 +36,72 @@ RUN pip install --no-cache-dir -r requirements.txt
 # -------- Fallback App code (used only if GIT_TOKEN/GIT_REPO not set) --------
 COPY app.py render.py /app/
 
-# -------- Runtime bootstrap to pull private repo safely --------
+# -------- Runtime bootstrap to pull private repo safely (no heredoc; robust on HF) --------
 # Expects Space settings:
 #   Secret:   GIT_TOKEN
 #   Variable: GIT_REPO   (e.g. owner/private-repo)
 #   Variable: GIT_REF    (optional, default "main")
 #   Variable: GIT_SUBDIR (optional, if app.py not at repo root)
-RUN set -eux; \
-  cat > /usr/local/bin/start.sh << 'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-
-export BLENDER_BIN="${BLENDER_BIN:-blender}"
-
-TARGET_ROOT="/srv/app"
-mkdir -p "$TARGET_ROOT"
-
-REPO="${GIT_REPO:-}"
-REF="${GIT_REF:-main}"
-SUBDIR="${GIT_SUBDIR:-}"
-
-use_bundled_fallback() {
-  echo "[info] Using bundled /app fallback (no private repo configured or fetch failed)."
-  rsync -a /app/ "${TARGET_ROOT}/"
-  cd "${TARGET_ROOT}"
-  exec python app.py
-}
-
-if [[ -z "${REPO}" ]] || [[ -z "${GIT_TOKEN:-}" ]]; then
-  use_bundled_fallback
-fi
-
-echo "[info] Downloading ${REPO}@${REF} tarball from GitHub..."
-ARCHIVE_URL="https://api.github.com/repos/${REPO}/tarball/${REF}"
-
-# Download using header auth; avoid printing token
-if ! wget -q --header="Authorization: Bearer ${GIT_TOKEN}" -O /tmp/repo.tar.gz "${ARCHIVE_URL}"; then
-  echo "[warn] Download failed; falling back to bundled app."
-  use_bundled_fallback
-fi
-
-# Extract and normalize to TARGET_ROOT (strip top dir)
-rm -rf "${TARGET_ROOT:?}/"*
-tar -xzf /tmp/repo.tar.gz -C "${TARGET_ROOT}" --strip-components=1
-rm -f /tmp/repo.tar.gz
-
-# Optional subdir
-if [[ -n "${SUBDIR}" ]]; then
-  if [[ -d "${TARGET_ROOT}/${SUBDIR}" ]]; then
-    TARGET_ROOT="${TARGET_ROOT}/${SUBDIR}"
-  else
-    echo "[warn] GIT_SUBDIR='${SUBDIR}' not found; continuing from repo root."
-  fi
-fi
-
-# Install repo-specific deps if present
-if [[ -f "${TARGET_ROOT}/requirements.txt" ]]; then
-  echo "[info] Installing repo requirements..."
-  pip install --no-cache-dir -r "${TARGET_ROOT}/requirements.txt"
-fi
-
-cd "${TARGET_ROOT}"
-
-# Sanity check
-if [[ ! -f "app.py" ]]; then
-  echo "[warn] app.py not found in repo path; falling back to bundled app."
-  use_bundled_fallback
-fi
-
-echo "[info] Starting app from private repo..."
-exec python app.py
-EOF
-RUN chmod +x /usr/local/bin/start.sh
+RUN printf '%s\n' \
+'#!/usr/bin/env bash' \
+'set -euo pipefail' \
+'' \
+'export BLENDER_BIN="${BLENDER_BIN:-blender}"' \
+'' \
+'TARGET_ROOT="/srv/app"' \
+'mkdir -p "$TARGET_ROOT"' \
+'' \
+'REPO="${GIT_REPO:-}"' \
+'REF="${GIT_REF:-main}"' \
+'SUBDIR="${GIT_SUBDIR:-}"' \
+'' \
+'use_bundled_fallback() {' \
+'  echo "[info] Using bundled /app fallback (no private repo configured or fetch failed)."' \
+'  rsync -a /app/ "${TARGET_ROOT}/"' \
+'  cd "${TARGET_ROOT}"' \
+'  exec python app.py' \
+'}' \
+'' \
+'if [[ -z "${REPO}" ]] || [[ -z "${GIT_TOKEN:-}" ]]; then' \
+'  use_bundled_fallback' \
+'fi' \
+'' \
+'echo "[info] Downloading ${REPO}@${REF} tarball from GitHub..."' \
+'ARCHIVE_URL="https://api.github.com/repos/${REPO}/tarball/${REF}"' \
+'' \
+'if ! wget -q --header="Authorization: Bearer ${GIT_TOKEN}" -O /tmp/repo.tar.gz "${ARCHIVE_URL}"; then' \
+'  echo "[warn] Download failed; falling back to bundled app."' \
+'  use_bundled_fallback' \
+'fi' \
+'' \
+'rm -rf "${TARGET_ROOT:?}/"*' \
+'tar -xzf /tmp/repo.tar.gz -C "${TARGET_ROOT}" --strip-components=1' \
+'rm -f /tmp/repo.tar.gz' \
+'' \
+'if [[ -n "${SUBDIR}" ]]; then' \
+'  if [[ -d "${TARGET_ROOT}/${SUBDIR}" ]]; then' \
+'    TARGET_ROOT="${TARGET_ROOT}/${SUBDIR}"' \
+'  else' \
+'    echo "[warn] GIT_SUBDIR=${SUBDIR} not found; continuing from repo root."' \
+'  fi' \
+'fi' \
+'' \
+'if [[ -f "${TARGET_ROOT}/requirements.txt" ]]; then' \
+'  echo "[info] Installing repo requirements..."' \
+'  pip install --no-cache-dir -r "${TARGET_ROOT}/requirements.txt"' \
+'fi' \
+'' \
+'cd "${TARGET_ROOT}"' \
+'' \
+'if [[ ! -f "app.py" ]]; then' \
+'  echo "[warn] app.py not found in repo path; falling back to bundled app."' \
+'  use_bundled_fallback' \
+'fi' \
+'' \
+'echo "[info] Starting app from private repo..."' \
+'exec python app.py' \
+> /usr/local/bin/start.sh \
+ && chmod +x /usr/local/bin/start.sh
 
 # Hugging Face Spaces env
 ENV PORT=7860 \