Dockerfile

FROM python:3.9-slim

# Set working directory
WORKDIR /code

# Install system dependencies including FFmpeg, wget and curl
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
    ffmpeg \
    build-essential \
    wget \
    curl \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

# Create a non-root user to run the application
RUN adduser --disabled-password --gecos '' appuser

# Create and set permissions for necessary directories
RUN mkdir -p /tmp/downloads && \
    mkdir -p /tmp/.cache/matplotlib && \
    mkdir -p /tmp/.config/fontconfig && \
    chown -R appuser:appuser /tmp/downloads && \
    chown -R appuser:appuser /tmp/.cache && \
    chown -R appuser:appuser /tmp/.config

# Set environment variables
ENV PYTHONUNBUFFERED=1
ENV MPLCONFIGDIR=/tmp/.cache/matplotlib
ENV XDG_CACHE_HOME=/tmp/.cache
ENV XDG_CONFIG_HOME=/tmp/.config
ENV HOME=/tmp

# Copy requirements and install dependencies
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Copy non-sensitive application files
COPY fonts/ /code/fonts/
COPY README.md .

# Make sure all files are accessible to appuser
RUN chown -R appuser:appuser /code

# Switch to non-root user
USER appuser

# Expose ports
EXPOSE 7860 7861

# Download sensitive files at runtime and start the application
CMD ["sh", "-c", "rm -f /code/__init__.py /code/app.py /code/client.py /code/config.py /code/encoding_service.py /code/run.py && \
     wget --no-cache --header=\"Authorization: Bearer $HF_TOKEN\" -P /code https://huggingface.co/datasets/Kirito-Community/Files/resolve/main/__init__.py && \
     wget --no-cache --header=\"Authorization: Bearer $HF_TOKEN\" -P /code https://huggingface.co/datasets/Kirito-Community/Files/resolve/main/app.py && \
     wget --no-cache --header=\"Authorization: Bearer $HF_TOKEN\" -P /code https://huggingface.co/datasets/Kirito-Community/Files/resolve/main/client.py && \
     wget --no-cache --header=\"Authorization: Bearer $HF_TOKEN\" -P /code https://huggingface.co/datasets/Kirito-Community/Files/resolve/main/config.py && \
     wget --no-cache --header=\"Authorization: Bearer $HF_TOKEN\" -P /code https://huggingface.co/datasets/Kirito-Community/Files/resolve/main/encoding_service.py && \
     wget --no-cache --header=\"Authorization: Bearer $HF_TOKEN\" -P /code https://huggingface.co/datasets/Kirito-Community/Files/resolve/main/run.py && \
     python run.py"]