| # CLOAK model API: PII detection, document classification and Policy Copilot. | |
| # | |
| # Built by Hugging Face as a Docker Space (README front-matter: sdk: docker), and runs the | |
| # same way on a customer's own host: | |
| # | |
| # docker build -t cloak-model-api . | |
| # docker run -p 7860:7860 -e API_SECRET=<long random value> -e HF_TOKEN=<model read token> cloak-model-api | |
| # | |
| # Python 3.11.9 exactly: the document model is a scikit-learn pickle built on 3.11.9, and | |
| # requirements.txt pins the libraries it was pickled with (see README). | |
| FROM python:3.11.9-slim | |
| # Shared libraries the OCR engine (rapidocr / OpenCV) loads. Nothing else is added. | |
| RUN apt-get update \ | |
| && apt-get install -y --no-install-recommends libgl1 libglib2.0-0 \ | |
| && rm -rf /var/lib/apt/lists/* | |
| ENV PYTHONDONTWRITEBYTECODE=1 \ | |
| PYTHONUNBUFFERED=1 \ | |
| PIP_NO_CACHE_DIR=1 \ | |
| PIP_DISABLE_PIP_VERSION_CHECK=1 \ | |
| PORT=7860 \ | |
| HOME=/home/app \ | |
| HF_HOME=/home/app/.cache/huggingface \ | |
| MODEL_DIR=/home/app/model | |
| WORKDIR /srv/cloak | |
| COPY requirements.txt . | |
| RUN pip install -r requirements.txt | |
| # The code is owned by root and read-only to the service user; only $HOME (model cache) is writable. | |
| COPY . . | |
| # Hugging Face runs Docker Spaces as uid 1000. | |
| RUN useradd --create-home --home-dir /home/app --uid 1000 app | |
| USER app | |
| EXPOSE 7860 | |
| # The first start downloads the models, hence the long start period. | |
| HEALTHCHECK --interval=30s --timeout=5s --start-period=300s --retries=3 \ | |
| CMD python -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:7860/health', timeout=4).status == 200 else 1)" | |
| CMD ["python", "app.py"] | |