Dockerfile

# Perch, as a single container: FastAPI serves both the API and the built
# frontend, so there is one origin and therefore no CORS, no mixed-content
# blocking, and no API base URL to keep in sync between two deployments.
FROM python:3.11-slim

# DuckDB's spatial extension is downloaded at runtime and needs CA certificates;
# the geo stack needs a compiler for the wheels that have no arm/musl build.
RUN apt-get update && apt-get install -y --no-install-recommends \
        ca-certificates build-essential \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Dependencies first, so a code or data change does not reinstall them.
COPY backend/requirements.txt ./backend/requirements.txt
RUN pip install --no-cache-dir -r backend/requirements.txt

COPY backend/ ./backend/

# Spaces run as a non-root user, and DuckDB needs somewhere writable for the
# spatial extension it fetches on first use.
RUN useradd -m -u 1000 perch && chown -R perch:perch /app
USER perch
ENV HOME=/home/perch \
    DUCKDB_HOME=/home/perch \
    PYTHONUNBUFFERED=1

# 7860 is the port Hugging Face Spaces expects.
EXPOSE 7860
CMD ["uvicorn", "backend.main:app", "--host", "0.0.0.0", "--port", "7860"]