Serve prebuilt app on Docker CPU Basic

Switch from credit-gated Static Space to a minimal Nginx Docker Space on port 7860. The container copies the verified dist bundle and preserves cross-origin isolation headers.

.dockerignore

@@ -0,0 +1,5 @@
+*
+!Dockerfile
+!nginx.conf
+!dist/
+!dist/**

Dockerfile

@@ -0,0 +1,14 @@
+FROM nginx:1.29-alpine@sha256:5616878291a2eed594aee8db4dade5878cf7edcb475e59193904b198d9b830de
+
+RUN adduser -D -u 1000 user
+
+COPY nginx.conf /etc/nginx/nginx.conf
+COPY --chown=user:user dist/ /home/user/app/
+
+USER user
+EXPOSE 7860
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+  CMD wget -qO- http://127.0.0.1:7860/healthz || exit 1
+
+CMD ["nginx", "-g", "daemon off;"]

README.md

@@ -3,16 +3,13 @@ title: Bonsai WebGPU Chat
 emoji: 🌱
 colorFrom: green
 colorTo: gray
-sdk: static
-app_file: dist/index.html
+sdk: docker
+app_port: 7860
+suggested_hardware: cpu-basic
 fullWidth: true
 short_description: Browser-local Bonsai WebGPU chat with agentic tools
 models:
 - WaveCut/Bonsai-web-GGUF
-custom_headers:
-  cross-origin-embedder-policy: require-corp
-  cross-origin-opener-policy: same-origin
-  cross-origin-resource-policy: cross-origin
 ---
 
 # Bonsai WebGPU Chat
@@ -37,16 +34,17 @@ to release commit `d85382fa09fe868c0242d81488dfc2edd8d3729b` (tag
 weight commit `112ea7a1a6229bde132b176b9a72477a7ecfde64`. Every shard has a recorded
 byte size and SHA-256.
 
-The repository includes the verified `dist/` production bundle because the
-current Hugging Face free static runtime requires credits for server-side build
-jobs. The checked-in bundle is produced by `npm ci && npm run build`; source,
-tests, lockfile, and exact runtime assets remain in the same Space repository.
+The repository includes the verified `dist/` production bundle. The CPU Basic
+Docker Space serves that bundle directly with Nginx and does not run npm or
+Vite during its container build. The checked-in bundle is produced locally by
+`npm ci && npm run build`; source, tests, lockfile, and exact runtime assets
+remain in the same Space repository.
 
 ## Browser requirements
 
 Chrome or Edge with WebGPU is recommended. CPU-WASM fallback requires a
-cross-origin-isolated browser with `SharedArrayBuffer`; the Space headers above
-enable it. Model storage uses the browser cache/OPFS path exposed by wllama and
+cross-origin-isolated browser with `SharedArrayBuffer`; the Nginx configuration
+enables it. Model storage uses the browser cache/OPFS path exposed by wllama and
 requests persistent storage before the first model byte is downloaded. A browser
 denial is non-fatal, and the storage panel lets the operator request it again.
 
@@ -68,11 +66,10 @@ the browser exposes the required cross-origin-isolated WASM features.
 
 ## Growth benchmark
 
-[`?view=bench`](https://wavecut-bonsai-webgpu-chat.static.hf.space/?view=bench)
-is a separate, shareable benchmark surface rendered by the root static app.
-Hugging Face Static Spaces serve one configured `app_file`, so the query
-deep-link keeps the benchmark executable under the same COOP/COEP headers. It
-loads nothing until **Run benchmark** is pressed, then records first-load and
+[`?view=bench`](https://wavecut-bonsai-webgpu-chat.hf.space/?view=bench)
+is a separate, shareable benchmark surface rendered by the same browser app.
+The query deep-link keeps the benchmark executable under the same COOP/COEP
+headers. It loads nothing until **Run benchmark** is pressed, then records first-load and
 verified-cache reload wall time, TTFT,
 prefill/decode throughput, graph placement, device limits, engine revisions,
 the exact runtime artifact hash, and a fixed temperature-0 prompt. Schema v3

nginx.conf

@@ -0,0 +1,41 @@
+worker_processes auto;
+pid /tmp/nginx.pid;
+error_log /dev/stderr notice;
+
+events {
+  worker_connections 1024;
+}
+
+http {
+  include /etc/nginx/mime.types;
+  default_type application/octet-stream;
+  access_log /dev/stdout;
+  sendfile on;
+
+  client_body_temp_path /tmp/client_temp;
+  proxy_temp_path /tmp/proxy_temp;
+  fastcgi_temp_path /tmp/fastcgi_temp;
+  uwsgi_temp_path /tmp/uwsgi_temp;
+  scgi_temp_path /tmp/scgi_temp;
+
+  server {
+    listen 7860;
+    server_name _;
+    root /home/user/app;
+    index index.html;
+
+    add_header Cross-Origin-Embedder-Policy "require-corp" always;
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+    add_header Cross-Origin-Resource-Policy "cross-origin" always;
+
+    location = /healthz {
+      access_log off;
+      default_type text/plain;
+      return 200 "ok\n";
+    }
+
+    location / {
+      try_files $uri $uri/ /index.html;
+    }
+  }
+}