Update Dockerfile

Dockerfile

@@ -1,50 +1,48 @@
-# Hugging Face Spaces Dockerfile (clone-from-GitHub variant).
-#
-# Pulls the source from a private GitHub repo using a build-time GITHUB_TOKEN
-# secret, then runs BOTH apps behind a single port that HF exposes:
-#   nginx (:8000 = app_port) -> FastAPI voice app (:8001)
-#                            -> Streamlit dashboard (:8501, under /dashboard)
-# supervisord keeps all three processes alive.
-
+# Hugging Face Docker Space.
+# Space settings -> Variables and secrets:
+#   GITHUB_TOKEN    (secret, read access to the private repo; used at build time)
+#   OPENAI_API_KEY  and the other .env values (secrets/variables, used at runtime)
 FROM python:3.12
 
-LABEL maintainer="ductz-demo"
-
-WORKDIR /workspace
+LABEL maintainer="insurance_agent"
 
-# git/build tools + nginx (reverse-proxies the app and dashboard onto one port).
-RUN apt-get update && apt-get install -y \
+RUN apt-get update && apt-get install -y --no-install-recommends \
     git \
     build-essential \
-    nginx \
     && rm -rf /var/lib/apt/lists/*
 
-# Clone the private repo using the GITHUB_TOKEN build secret. The token is
-# mounted only for this step and is NOT baked into any image layer.
-RUN --mount=type=secret,id=GITHUB_TOKEN,mode=0444,required=true \
-    git clone https://$(cat /run/secrets/GITHUB_TOKEN)@github.com/saghir-abbasi/duct_z.git /workspace
+RUN pip install --no-cache-dir uv
 
-RUN pip install uv
-RUN uv sync --frozen
-# supervisord (in the project venv) manages uvicorn + streamlit + nginx.
-RUN uv pip install supervisor
+# Spaces run the container as UID 1000; build as that user so every file
+# (profiles, active_profile.json, Chroma stores) is writable at runtime.
+RUN useradd --create-home --uid 1000 user
+USER user
 
-# Run as a non-root user with UID 1000 (Hugging Face Spaces convention) and let
-# it own /workspace plus nginx's runtime dirs so nginx can run unprivileged.
-RUN useradd -m -u 1000 appuser \
-    && mkdir -p /var/lib/nginx /var/log/nginx \
-    && chown -R appuser:appuser /workspace /var/lib/nginx /var/log/nginx
+ENV HOME=/home/user \
+    PATH=/home/user/app/.venv/bin:$PATH \
+    PYTHONUNBUFFERED=1 \
+    UV_LINK_MODE=copy \
+    FASTEMBED_CACHE_PATH=/home/user/app/.cache/fastembed
 
-USER appuser
+WORKDIR /home/user/app
+
+# Bump to force a fresh clone when the Docker layer cache would reuse an old one.
+ARG REPO_REVISION=1
+
+# Use token to clone the private repo
+RUN --mount=type=secret,id=GITHUB_TOKEN,mode=0444,required=true \
+    git clone --depth 1 https://$(cat /run/secrets/GITHUB_TOKEN)@github.com/saghir-abbasi/call_center_demo.git . \
+    && rm -rf .git
 
-# Build the structured catalog DB and the local Chroma vector store at
-# image-build time. `uv run ingest` also downloads the fastembed model
-# (~110MB) into the cache, so the first runtime query is fast.
-RUN uv run build_db
-RUN uv run ingest
+RUN uv sync --frozen --no-dev
 
-EXPOSE 8000
+# Build the Chroma vector stores of every agent profile (data/profiles/*/knowledge.*)
+# at image-build time. This also downloads the fastembed model (~110MB) into
+# FASTEMBED_CACHE_PATH, so the first runtime call is fast.
+RUN uv run --no-sync ingest --all
 
-# nginx (public :8000) fronts FastAPI :8001 and Streamlit :8501 (/dashboard).
-CMD ["/workspace/.venv/bin/supervisord", "-c", "/workspace/deploy/supervisord.conf"]
+EXPOSE 7860
 
+# The browser call page (/app) opens its WebSocket on whatever host served it,
+# so no DOMAIN_URL override is needed for the port.
+CMD ["uvicorn", "src.insurance_agent.main:app", "--host", "0.0.0.0", "--port", "7860"]