Dockerfile

# syntax=docker/dockerfile:1.6
# Hugging Face Spaces — v2 backend (reference-only, canonical RICS L3 schema).
FROM python:3.11-slim AS production

RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    libgomp1 \
    curl \
    && rm -rf /var/lib/apt/lists/*

ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PIP_NO_CACHE_DIR=1 \
    PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    HOME=/home/user \
    PORT=7860 \
    DATA_DIR=/data \
    MASTER_TEMPLATE_AUTO_INGEST=false \
    REFERENCE_AUTO_INGEST_ENABLED=false

WORKDIR /app

COPY backend/requirements.txt ./backend/requirements.txt
RUN pip install --upgrade pip && \
    pip install -r backend/requirements.txt && \
    python -m spacy download en_core_web_sm

COPY backend ./backend
COPY frontend ./frontend

RUN groupadd -g 1000 appgroup && \
    useradd -u 1000 -g appgroup -d /home/user -m -s /sbin/nologin appuser && \
    mkdir -p /data/tmp /data/hf_cache && \
    chown -R appuser:appgroup /app /data /home/user

USER appuser

EXPOSE 7860

HEALTHCHECK --interval=30s --timeout=10s --start-period=120s --retries=3 \
    CMD curl -fsS "http://127.0.0.1:${PORT:-7860}/health" || exit 1

CMD ["sh", "-c", "exec uvicorn backend.main:app --host 0.0.0.0 --port ${PORT:-7860} --workers 1"]