Spaces:

Catalna
/

ginchiee-bot

Running on Zero

feat: switch to Postgres, add intent router and a warmer persona

1fcc069 29 days ago

1.19 kB

FROM python:3.11-slim

# No build-essential / sqlite3: nothing here compiles C extensions (asyncpg
# ships wheels), so the packages only inflate the image and its attack surface.
WORKDIR /app

# Copy and install dependencies first so layer caching works when only code
# changes.
COPY requirements.txt .
RUN pip install --no-cache-dir --upgrade pip \
    && pip install --no-cache-dir -r requirements.txt

# Copy only the source. .dockerignore excludes .env, data/, .venv/, .git/ and
# the OAuth secrets, so credentials and user data cannot leak into the image.
COPY . .

# The app writes nothing to disk: all state lives in Postgres. Create a
# non-writable runtime directory only so a stray relative path cannot fail.
RUN mkdir -p /app/data \
    && chmod 755 /app/data

# Run as a non-root user.
RUN useradd --create-home --uid 10001 ginchiee \
    && chown -R ginchiee:ginchiee /app
USER ginchiee

# Hugging Face Spaces port. main.py serves a lightweight health endpoint on it.
ENV PORT=7860
EXPOSE 7860

# DATABASE_URL (plus TELEGRAM_BOT_TOKEN / GEMINI_API_KEY) must be supplied at
# runtime via Space Secrets or `docker run -e`, never baked into the image.
CMD ["python", "main.py"]

	FROM python:3.11-slim

	# No build-essential / sqlite3: nothing here compiles C extensions (asyncpg
	# ships wheels), so the packages only inflate the image and its attack surface.
	WORKDIR /app

	# Copy and install dependencies first so layer caching works when only code
	# changes.
	COPY requirements.txt .
	RUN pip install --no-cache-dir --upgrade pip \
	&& pip install --no-cache-dir -r requirements.txt

	# Copy only the source. .dockerignore excludes .env, data/, .venv/, .git/ and
	# the OAuth secrets, so credentials and user data cannot leak into the image.
	COPY . .

	# The app writes nothing to disk: all state lives in Postgres. Create a
	# non-writable runtime directory only so a stray relative path cannot fail.
	RUN mkdir -p /app/data \
	&& chmod 755 /app/data

	# Run as a non-root user.
	RUN useradd --create-home --uid 10001 ginchiee \
	&& chown -R ginchiee:ginchiee /app
	USER ginchiee

	# Hugging Face Spaces port. main.py serves a lightweight health endpoint on it.
	ENV PORT=7860
	EXPOSE 7860

	# DATABASE_URL (plus TELEGRAM_BOT_TOKEN / GEMINI_API_KEY) must be supplied at
	# runtime via Space Secrets or `docker run -e`, never baked into the image.
	CMD ["python", "main.py"]