Dockerfile

# ---------- Stage 1: build dependencies ----------
FROM python:3.11-slim AS builder

WORKDIR /app

# System deps for PyMuPDF and chromadb native builds
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        build-essential \
        libffi-dev \
    && rm -rf /var/lib/apt/lists/*

COPY requirements.txt .
RUN pip install --no-cache-dir --prefix=/install -r requirements.txt

# ---------- Stage 2: runtime image ----------
FROM python:3.11-slim

# HF Spaces requires a non-root user with uid 1000
RUN useradd -m -u 1000 user
WORKDIR /home/user/app

# Minimal runtime libraries needed by PyMuPDF / Pillow
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        libglib2.0-0 \
        libsm6 \
        libxext6 \
        libxrender1 \
    && rm -rf /var/lib/apt/lists/*

# Copy installed Python packages from the builder stage
COPY --from=builder /install /usr/local

# Copy application source and set ownership to non-root user
COPY --chown=user:user . .

# Writable cache directories for the non-root user
RUN mkdir -p /home/user/app/.cache && chown -R user:user /home/user/app/.cache

USER user

ENV PYTHONUNBUFFERED=1
ENV HOME=/home/user
ENV PATH="/home/user/.local/bin:$PATH"

# HF Spaces expects port 7860
ENV STREAMLIT_SERVER_PORT=7860
ENV STREAMLIT_SERVER_ADDRESS=0.0.0.0
ENV STREAMLIT_BROWSER_GATHER_USAGE_STATS=false

EXPOSE 7860

HEALTHCHECK CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:7860/_stcore/health')"

ENTRYPOINT ["streamlit", "run", "app.py"]