FROM python:3.11-slim

# Create a non-root user for Hugging Face security
RUN useradd -m -u 1000 user
USER user
ENV PATH="/home/user/.local/bin:$PATH"

WORKDIR /app

# Switch to root temporarily to install system packages
USER root
RUN apt-get update && apt-get install -y \
    build-essential \
    && rm -rf /var/lib/apt/lists/*

# Switch back to the non-root user
USER user

# Copy project files and set ownership
COPY --chown=user . .

# Install dependencies
RUN pip install --no-cache-dir chromadb pypdf google-genai[embeddings] python-dotenv fastapi uvicorn pydantic-settings python-multipart

# Expose port (Hugging Face uses 7860)
EXPOSE 7860

# Command to run the application
CMD ["python", "server.py"]