Fix permission denied: store models/data outside /app mount

HF Spaces mounts repo content over /app/ at runtime, overwriting
Docker build-time permissions. Move model downloads to /home/user/models/
and data storage to /home/user/data/ which persist from build. All source
files now use MODEL_DIR and DATA_DIR env vars for path resolution.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Dockerfile

@@ -15,26 +15,30 @@ COPY requirements.txt .
 # Install Python dependencies
 RUN pip install --no-cache-dir -r requirements.txt
 
-# Copy application code
-COPY . .
+# HF Spaces runs as user 1000 - create user before downloads
+RUN useradd -m -u 1000 user
 
-# Create necessary directories with proper permissions
-RUN mkdir -p data/db data/clips pretrained_models
+# Create model & data dirs under /home/user (NOT /app, which HF mounts over)
+RUN mkdir -p /home/user/models/vad /home/user/models/spkrec \
+    /home/user/data/db /home/user/data/clips \
+    && chown -R user:user /home/user
 
-# Pre-download SpeechBrain models during build
+# Pre-download models AS the user so files are owned by user
+USER user
 RUN python -c "\
 from speechbrain.inference.VAD import VAD; \
-VAD.from_hparams(source='speechbrain/vad-crdnn-libriparty', savedir='pretrained_models/vad'); \
+VAD.from_hparams(source='speechbrain/vad-crdnn-libriparty', savedir='/home/user/models/vad'); \
 print('VAD model downloaded')"
 
 RUN python -c "\
 from speechbrain.inference.speaker import SpeakerRecognition; \
-SpeakerRecognition.from_hparams(source='speechbrain/spkrec-ecapa-voxceleb', savedir='pretrained_models/spkrec'); \
+SpeakerRecognition.from_hparams(source='speechbrain/spkrec-ecapa-voxceleb', savedir='/home/user/models/spkrec'); \
 print('Speaker Recognition model downloaded')"
 
-# HF Spaces runs as user 1000 - set permissions
-RUN useradd -m -u 1000 user
-RUN chown -R user:user /app && chmod -R 775 /app/pretrained_models /app/data
+# Copy application code (switch back to root, then back to user)
+USER root
+COPY . .
+RUN chown -R user:user /app
 USER user
 
 # Expose port (HF Spaces uses 7860)
@@ -46,6 +50,8 @@ ENV STREAMLIT_SERVER_ADDRESS=0.0.0.0
 ENV HOME=/home/user
 ENV MPLCONFIGDIR=/tmp/matplotlib
 ENV HF_HOME=/tmp/hf_home
+ENV MODEL_DIR=/home/user/models
+ENV DATA_DIR=/home/user/data
 
 # Run Streamlit
 CMD ["streamlit", "run", "app.py", "--server.port=7860", "--server.address=0.0.0.0", "--server.headless=true"]

src/analyzer.py

@@ -145,8 +145,8 @@ class AnalysisResult:
 class AudioAnalyzer:
     """Main analyzer that orchestrates all phases."""
     
-    def __init__(self, db_path: str = "data/db/voiceprints.db",
-                 clips_dir: str = "data/clips",
+    def __init__(self, db_path: str = None,
+                 clips_dir: str = None,
                  device: str = None):
         """
         Initialize analyzer.
@@ -157,9 +157,14 @@ class AudioAnalyzer:
             device: torch device (cuda/cpu)
         """
         self.device = device
+        data_dir = os.environ.get("DATA_DIR", "data")
+        if db_path is None:
+            db_path = os.path.join(data_dir, "db", "voiceprints.db")
+        if clips_dir is None:
+            clips_dir = os.path.join(data_dir, "clips")
         self.clips_dir = clips_dir
         os.makedirs(clips_dir, exist_ok=True)
-        
+
         # Initialize database
         self.db = Database(db_path)
         

src/database/models.py

@@ -77,7 +77,10 @@ class TestAnalysis(Base):
 class Database:
     """Database manager."""
     
-    def __init__(self, db_path: str = "data/db/voiceprints.db"):
+    def __init__(self, db_path: str = None):
+        if db_path is None:
+            data_dir = os.environ.get("DATA_DIR", "data")
+            db_path = os.path.join(data_dir, "db", "voiceprints.db")
         self.db_path = db_path
         os.makedirs(os.path.dirname(db_path), exist_ok=True)
         self.engine = create_engine(f'sqlite:///{db_path}')

src/phase1_foundation/diarization.py

@@ -45,9 +45,11 @@ class SpeakerDiarizer:
         """Lazy load embedding model."""
         if self._embedding_model is None:
             from speechbrain.inference.speaker import SpeakerRecognition
+            import os
+            model_dir = os.environ.get("MODEL_DIR", "pretrained_models")
             self._embedding_model = SpeakerRecognition.from_hparams(
                 source="speechbrain/spkrec-ecapa-voxceleb",
-                savedir="pretrained_models/spkrec",
+                savedir=os.path.join(model_dir, "spkrec"),
                 run_opts={"device": self.device}
             )
         return self._embedding_model

src/phase1_foundation/vad.py

@@ -33,9 +33,11 @@ class VoiceActivityDetector:
             # Suppress the use_auth_token deprecation warning from speechbrain
             with warnings.catch_warnings():
                 warnings.filterwarnings("ignore", message=".*use_auth_token.*")
+                import os
+                model_dir = os.environ.get("MODEL_DIR", "pretrained_models")
                 self._model = VAD.from_hparams(
                     source="speechbrain/vad-crdnn-libriparty",
-                    savedir="pretrained_models/vad",
+                    savedir=os.path.join(model_dir, "vad"),
                     run_opts={"device": self.device}
                 )
         return self._model

src/phase1_foundation/voiceprint.py

@@ -47,9 +47,11 @@ class VoiceprintExtractor:
         """Lazy load model."""
         if self._model is None:
             from speechbrain.inference.speaker import SpeakerRecognition
+            import os
+            model_dir = os.environ.get("MODEL_DIR", "pretrained_models")
             self._model = SpeakerRecognition.from_hparams(
                 source="speechbrain/spkrec-ecapa-voxceleb",
-                savedir="pretrained_models/spkrec",
+                savedir=os.path.join(model_dir, "spkrec"),
                 run_opts={"device": self.device}
             )
         return self._model