Dockerfile

# DeepFakeScanner — single-image deployment for HF Spaces, Cloud Run, Modal, etc.
#
# Build:
#   docker build -t deepfake-scanner .
# Run:
#   docker run -p 7860:7860 deepfake-scanner
#
# Lives at the repo root because HF Spaces' Docker SDK builds from ./Dockerfile.
# Port 7860 is the HF Spaces default. Override with the PORT env var on
# other platforms (Cloud Run injects PORT automatically).

FROM python:3.11-slim AS builder

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1

# Build deps (some Python wheels still compile on slim).
RUN apt-get update && apt-get install -y --no-install-recommends \
        build-essential \
        libgl1 \
        libglib2.0-0 \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Install CPU-only PyTorch first to keep the image lean (~700 MB instead of ~3 GB).
COPY requirements.txt .
RUN pip install --index-url https://download.pytorch.org/whl/cpu torch torchvision \
    && pip install -r requirements.txt

# Copy source.
COPY src/ ./src/
COPY scripts/ ./scripts/
COPY pyproject.toml .

# Install the package.
RUN pip install -e .

# Pre-download CLIP backbone weights so first request isn't slow. This is a
# public download — no auth needed.
RUN python scripts/download_weights.py

# NOTE: the Stage 2 head weights (Veridicate/scanner-head-v1) are NOT
# pre-downloaded here. That repo is private, and HF Spaces does not expose
# secrets to a plain `RUN` at build time (it would need a BuildKit
# --mount=type=secret). Instead, ClipClassifier downloads the head at
# container startup using the HF_TOKEN secret, which IS available at
# runtime. The head is only ~530 KB so the startup cost is negligible.
# See config.py:head_checkpoint_hf_repo and clip_classifier.py.

# ---------------------------------------------------------------------------
# Final image
# ---------------------------------------------------------------------------
FROM python:3.11-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PORT=7860

RUN apt-get update && apt-get install -y --no-install-recommends \
        libgl1 \
        libglib2.0-0 \
    && rm -rf /var/lib/apt/lists/*

# Copy installed packages and HF cache from builder.
COPY --from=builder /usr/local/lib/python3.11/site-packages /usr/local/lib/python3.11/site-packages
COPY --from=builder /usr/local/bin /usr/local/bin
COPY --from=builder /root/.cache/huggingface /root/.cache/huggingface
COPY --from=builder /app /app

WORKDIR /app

EXPOSE 7860

# Use a wrapper so the PORT env var (Cloud Run) is honoured.
CMD ["sh", "-c", "uvicorn deepfake_scanner.api.v1:app --host 0.0.0.0 --port ${PORT:-7860}"]