Update Dockerfile

Dockerfile

@@ -5,10 +5,9 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     PIP_NO_CACHE_DIR=1 \
     STREAMLIT_BROWSER_GATHER_USAGE_STATS=false \
     HOME=/app \
-    # where your app will save uploaded files
-    UPLOAD_DIR=/app/uploads \
-    # ensure temp files (e.g., file_uploader buffers) are writable
-    TMPDIR=/app/tmp
+    # 🔐 force writable paths on HF Spaces
+    UPLOAD_DIR=/data/uploads \
+    TMPDIR=/data/tmp
 
 WORKDIR /app
 
@@ -25,20 +24,25 @@ RUN pip install --upgrade pip \
 # App source
 COPY src/ ./src/
 
-# Create writable dirs for Streamlit & uploads
-RUN mkdir -p /app/.streamlit /app/uploads /app/tmp
+# Streamlit config dir (lives in image layer, ok)
+RUN mkdir -p /app/.streamlit
 
-# (Optional) run as non-root for security
-# RUN useradd -m -d /app appuser && chown -R appuser:appuser /app
-# USER appuser
+# ✅ Create writable persistent dirs and grant permissions
+# /data is the only writable volume on Hugging Face Spaces.
+RUN mkdir -p /data/uploads /data/tmp \
+ && chmod -R 777 /data
 
-# Persist uploads across restarts (host can mount this)
-VOLUME ["/app/uploads"]
+# (Optional) non-root – if you uncomment, make sure /data is owned or world-writable
+# RUN useradd -m -d /app appuser && chown -R appuser:appuser /app /data
+# USER appuser
 
 EXPOSE 8501
 
 # Healthcheck
 HEALTHCHECK CMD curl --fail http://localhost:8501/_stcore/health || exit 1
 
-# Entrypoint
-ENTRYPOINT ["streamlit", "run", "src/streamlit_app.py", "--server.port=8501", "--server.address=0.0.0.0"]
+# 🚀 Start Streamlit with flags that avoid proxy/XSRF issues on Spaces
+ENTRYPOINT ["streamlit", "run", "src/streamlit_app.py",
+  "--server.port=8501", "--server.address=0.0.0.0",
+  "--server.enableXsrfProtection=false",
+  "--server.enableCORS=false"]