Dockerfile

FROM python:3.11-slim

# Avoid interactive prompts during apt
ENV DEBIAN_FRONTEND=noninteractive \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    HF_HOME=/tmp/hf_cache \
    HF_HUB_DISABLE_PROGRESS_BARS=1 \
    TOKENIZERS_PARALLELISM=false

WORKDIR /app

# System deps for sentencepiece/tokenizers wheels: usually nothing extra needed
# on slim, but keep build-essential out to keep the image small.

COPY requirements.txt .
RUN pip install -r requirements.txt

COPY app.py .

# HF Spaces routes external traffic to port 7860 by default.
EXPOSE 7860

# Streamlit needs to listen on 0.0.0.0 inside the container so the Space's
# reverse proxy can reach it. --server.headless avoids opening a browser
# during launch (no display in a container). We deliberately keep CORS and
# XSRF protection at their Streamlit defaults — disabling both at once puts
# Streamlit into a broken state where the websocket handshake never completes
# and the page renders an empty <div id="root">.
# XSRF protection must be off so that Streamlit accepts websocket frames
# from a parent iframe at a different origin (huggingface.co). Keep CORS
# enabled — turning *both* off puts Streamlit into a degraded state where
# it never finishes the websocket handshake.
CMD ["streamlit", "run", "app.py", \
     "--server.port=7860", \
     "--server.address=0.0.0.0", \
     "--server.headless=true", \
     "--server.enableXsrfProtection=false", \
     "--browser.gatherUsageStats=false"]