Dockerfile

# =====================================================================
# 1. SYSTEM LAYER (Executed safely as Root)
# =====================================================================
FROM python:3.11-slim

ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1

# Install bare-metal system libraries required by Chromium
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl \
    git \
    libglib2.0-0 \
    libnss3 \
    libatk1.0-0 \
    libatk-bridge2.0-0 \
    libcups2 \
    libdrm2 \
    libxkbcommon0 \
    libxcomposite1 \
    libxdamage1 \
    libxext6 \
    libxfixes3 \
    libxrandr2 \
    libgbm1 \
    libpango-1.0-0 \
    libcairo2 \
    libasound2 \
    libxshmfence1 \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Create the Hugging Face user profile
RUN useradd -m -u 1000 user

# Create empty target directories and give ownership to the user immediately
RUN mkdir -p /home/user/app /home/user/venv && \
    chown -R user:user /home/user

# =====================================================================
# 2. USER SANDBOX LAYER (Safe from Hugging Face Permission Blocks)
# =====================================================================
USER user
WORKDIR /home/user/app

# Instantiate and force the Virtual Environment to be the primary system path
RUN python -m venv /home/user/venv
ENV PATH="/home/user/venv/bin:$PATH"
ENV PYTHONPATH=/home/user/app
ENV PLAYWRIGHT_BROWSERS_PATH=/home/user/venv/ms-playwright

# Upgrade pip inside our isolated sandbox space
RUN pip install --no-cache-dir --upgrade pip

# =====================================================================
# 3. DEPENDENCY & CODE INGESTION
# =====================================================================
# 🔥 FIXED: Copy requirements.txt directly from the repository root workspace
COPY --chown=user:user requirements.txt ./

RUN pip install --no-cache-dir -r requirements.txt

# Install Playwright and the Chromium binaries entirely within user space
RUN pip install --no-cache-dir playwright && \
    playwright install chromium

# Bring in the rest of your app files under native user ownership
COPY --chown=user:user . .

EXPOSE 7860

# =====================================================================
# 4. RUNTIME EXECUTION
# =====================================================================
# 🔥 FIXED: Targeted directly to main:app since main.py sits at repository root level
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "7860"]