Dockerfile

FROM python:3.9-slim-bookworm

# Create non-root user for security
RUN useradd -m -u 1000 user

# Install system dependencies needed for OpenCV and MediaPipe
RUN apt-get update && apt-get install -y \
    libglib2.0-0 \
    libsm6 \
    libxext6 \
    libxrender-dev \
    libgomp1 \
    libgstreamer1.0-0 \
    libgstreamer-plugins-base1.0-0 \
    gstreamer1.0-plugins-good \
    libgstreamer-plugins-bad1.0-0 \
    gstreamer1.0-plugins-ugly \
    gstreamer1.0-tools \
    ffmpeg \
    libgl1 \
    libglx-mesa0 \
    wget \
    curl \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

# Set working directory
WORKDIR /app

# Create necessary directories with proper permissions
RUN mkdir -p /tmp/matplotlib \
    && mkdir -p /tmp/mediapipe \
    && mkdir -p /tmp/gradio \
    && mkdir -p /home/user/.cache/matplotlib \
    && mkdir -p /home/user/.cache/pip \
    && mkdir -p /home/user/.local/lib/python3.9/site-packages \
    && chown -R user:user /app \
    && chown -R user:user /tmp \
    && chown -R user:user /home/user

# Set environment variables for headless operation and disable GPU
ENV OPENCV_IO_ENABLE_JASPER=1
ENV OPENCV_IO_ENABLE_OPENEXR=1
ENV MPLCONFIGDIR=/home/user/.cache/matplotlib
ENV MEDIAPIPE_CACHE_DIR=/tmp/mediapipe
ENV GRADIO_TEMP_DIR=/tmp/gradio
ENV HOME=/home/user
ENV PATH="/home/user/.local/bin:${PATH}"
ENV PYTHONPATH="${PYTHONPATH}:/home/user/.local/lib/python3.9/site-packages"
# Disable GPU and OpenGL for MediaPipe in headless environment
ENV MESA_GL_VERSION_OVERRIDE=3.3
ENV MESA_GLSL_VERSION_OVERRIDE=330
ENV LIBGL_ALWAYS_SOFTWARE=1
ENV DISPLAY=:99
ENV MEDIAPIPE_DISABLE_GPU=1

# Switch to non-root user
USER user

# Copy and install Python dependencies
COPY --chown=user:user requirements.txt .
RUN pip install --no-cache-dir --user --upgrade pip
RUN pip install --no-cache-dir --user -r requirements.txt

# Pre-download MediaPipe models to avoid runtime downloads
RUN python -c "import mediapipe as mp; mp.solutions.pose.Pose()"

# Copy application code
COPY --chown=user:user app.py .

# Expose the port that FastAPI uses
EXPOSE 7860

# Run the application with uvicorn
CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860"]