| FROM python:3.12-slim | |
| WORKDIR /app | |
| ENV PYTHONUNBUFFERED=1 PIP_NO_CACHE_DIR=1 | |
| COPY pyproject.toml README.md ./ | |
| COPY lumen_rag ./lumen_rag | |
| RUN pip install --no-cache-dir ".[openai]" | |
| # Run unprivileged. The app writes its index (.lumen_index) under /app, so | |
| # the user owns the workdir; uid 1000 also matches Hugging Face Docker Spaces. | |
| RUN useradd --create-home --uid 1000 app && chown app:app /app | |
| USER app | |
| EXPOSE 8000 | |
| CMD ["lumen", "serve", "--host", "0.0.0.0", "--port", "8000"] | |