Dockerfile

FROM python:3.10-slim-bookworm

# Set environment variables
ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1

# Install system dependencies:
# - libpango/cairo/gdk-pixbuf/ffi + fonts-noto-cjk: WeasyPrint (optional PDF engine)
# - curl: container-internal health check probe
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl \
    libpango-1.0-0 \
    libpangocairo-1.0-0 \
    libcairo2 \
    libgdk-pixbuf-2.0-0 \
    libffi-dev \
    fonts-noto-cjk \
    fonts-noto-cjk-extra \
    fonts-liberation \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

# Set working directory
WORKDIR /app

# Copy requirements and install Python dependencies
COPY requirements.txt .
RUN pip install --no-cache-dir --upgrade pip && \
    pip install --no-cache-dir -r requirements.txt

# Copy application code
COPY . .

# Expose Streamlit port
EXPOSE 7860

# Health check (uses Streamlit's built-in health endpoint)
HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
    CMD curl -f http://localhost:7860/_stcore/health || exit 1

# Run application (Streamlit, single container, single port 7860)
# 关闭 XSRF / CORS 防护：HF Spaces 的反向代理 / iframe 环境下，Streamlit 默认的
# XSRF 防护会拦截文件上传端点（/_stcore/upload_file）导致 403。显式传参与
# .streamlit/config.toml 双保险，确保上传放行。
CMD ["streamlit", "run", "core/app.py", \
     "--server.port=7860", \
     "--server.address=0.0.0.0", \
     "--server.enableXsrfProtection=false", \
     "--server.enableCORS=false"]