Dockerfile

FROM python:3.12-slim

# Install system dependencies for WeasyPrint and scanners
# hadolint ignore=DL3008
RUN apt-get update && apt-get install -y --no-install-recommends \
    libpango-1.0-0 \
    libpangoft2-1.0-0 \
    libffi-dev \
    libcairo2 \
    git \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Install Python dependencies first (layer cache)
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Copy application source
COPY . .

# Persistent data volume
VOLUME ["/data"]

# HF Spaces expects port 7860
EXPOSE 7860

ENV DATABASE_URL="sqlite+aiosqlite:////data/sentinel.db" \
    DATA_DIR="/data" \
    HF_TOKEN="" \
    AI_EXPLAINER_MODE="off" \
    PYTHONUNBUFFERED="1"

# Run migrations then start server
CMD ["sh", "-c", \
     "python -m alembic -c alembic.ini upgrade head && \
      uvicorn sentinel.app:create_app --factory --host 0.0.0.0 --port 7860 --workers 1"]