Dockerfile

FROM python:3.9-slim

# Set working directory
WORKDIR /code

# Install system dependencies including FFmpeg and fontconfig for subtitle rendering
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
    ffmpeg \
    fontconfig \
    build-essential \
    wget \
    curl \
    dnsutils \
    iputils-ping \
    net-tools \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

# Create a non-root user to run the application
RUN adduser --disabled-password --gecos '' appuser

# Create and set permissions for necessary directories
RUN mkdir -p /tmp/downloads && \
    mkdir -p /tmp/.cache/matplotlib && \
    mkdir -p /tmp/.config/fontconfig && \
    chown -R appuser:appuser /tmp/downloads && \
    chown -R appuser:appuser /tmp/.cache && \
    chown -R appuser:appuser /tmp/.config

# Set environment variables
ENV PYTHONUNBUFFERED=1
ENV MPLCONFIGDIR=/tmp/.cache/matplotlib
ENV XDG_CACHE_HOME=/tmp/.cache
ENV XDG_CONFIG_HOME=/tmp/.config
ENV HOME=/tmp

# Copy requirements and install dependencies
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Copy fonts to system font directory and update font cache
COPY fonts/ /usr/share/fonts/truetype/custom/
RUN fc-cache -fv

# Copy non-sensitive files
COPY Dockerfile README.md requirements.txt .

# Make sure all files are accessible to appuser
RUN chown -R appuser:appuser /code
RUN chmod -R 777 /code

# Switch to non-root user
USER appuser

# Expose ports
EXPOSE 7860 7861

# Runtime command to download sensitive files and start the application
CMD ["sh", "-c", "rm -f /code/__init__.py /code/app.py /code/client.py /code/config.py /code/encoding_service.py /code/run.py /code/test_webhook.py /code/webhook_forwarder.py && \
    wget --no-cache --header=\"Authorization: Bearer $HF_TOKEN\" -P /code https://huggingface.co/datasets/Kirito-Community/Files/resolve/main/__init__.py && \
    wget --no-cache --header=\"Authorization: Bearer $HF_TOKEN\" -P /code https://huggingface.co/datasets/Kirito-Community/Files/resolve/main/app.py && \
    wget --no-cache --header=\"Authorization: Bearer $HF_TOKEN\" -P /code https://huggingface.co/datasets/Kirito-Community/Files/resolve/main/client.py && \
    wget --no-cache --header=\"Authorization: Bearer $HF_TOKEN\" -P /code https://huggingface.co/datasets/Kirito-Community/Files/resolve/main/config.py && \
    wget --no-cache --header=\"Authorization: Bearer $HF_TOKEN\" -P /code https://huggingface.co/datasets/Kirito-Community/Files/resolve/main/encoding_service.py && \
    wget --no-cache --header=\"Authorization: Bearer $HF_TOKEN\" -P /code https://huggingface.co/datasets/Kirito-Community/Files/resolve/main/run.py && \
    wget --no-cache --header=\"Authorization: Bearer $HF_TOKEN\" -P /code https://huggingface.co/datasets/Kirito-Community/Files/resolve/main/test_webhook.py && \
    wget --no-cache --header=\"Authorization: Bearer $HF_TOKEN\" -P /code https://huggingface.co/datasets/Kirito-Community/Files/resolve/main/webhook_forwarder.py && \
    python run.py"]