Dockerfile

FROM ubuntu:22.04

# Prevent tzdata/interactive prompts during apt-get
ENV DEBIAN_FRONTEND=noninteractive

# Install dependencies and OpenSSH server
# We create /run/sshd here as root because the daemon expects the directory to exist, 
# even when run later as a non-root user.
RUN apt-get update && \
    apt-get install -y wget openssh-server python3 && \
    mkdir -p /run/sshd && \
    chmod 755 /run/sshd && \
    rm -rf /var/lib/apt/lists/*

# Download and install the latest cloudflared binary
RUN wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb && \
    dpkg -i cloudflared-linux-amd64.deb && \
    rm cloudflared-linux-amd64.deb

# Create the non-root user (Hugging Face expects UID 1000)
RUN useradd -m -u 1000 -s /bin/bash user
USER user
ENV HOME=/home/user \
    PATH=/home/user/.local/bin:$PATH

WORKDIR $HOME

# Copy the startup script and set permissions
COPY --chown=user:user start.sh $HOME/start.sh
RUN chmod +x $HOME/start.sh

# Expose the HF health-check port and the internal SSH port
EXPOSE 7860 2222

CMD ["./start.sh"]