Fix: Set HF_HOME explicitly and add cache cleanup for model download permissions

Dockerfile

@@ -1,14 +1,23 @@
 # Dockerfile
 
-# Use a base image with Python installed. Python 3.10 or 3.11 are good choices.
-# We choose a Debian-based image for compatibility with apt_packages.
+# Use a base image with Python installed. Python 3.10 is fine.
 FROM python:3.10-slim-buster
 
+# Create the user and set it for subsequent commands
+RUN useradd -m -u 1000 user
+USER user
+
 # Set the working directory inside the container
 WORKDIR /app
 
+# Set the Hugging Face cache directory to a path where the 'user' has write permissions.
+# This prevents permission issues with /root/.cache and similar system paths.
+ENV HF_HOME=/app/huggingface_cache
+
+# Create the cache directory and ensure the 'user' owns it
+RUN mkdir -p $HF_HOME && chown user:user $HF_HOME
+
 # Install system dependencies needed for pdf2image (Poppler) and pytesseract (Tesseract)
-# These correspond to the apt_packages listed in your requirements.txt comments.
 RUN apt-get update && apt-get install -y \
     libpoppler-dev \
     tesseract-ocr \
@@ -16,26 +25,25 @@ RUN apt-get update && apt-get install -y \
     tesseract-ocr-tur \
     tesseract-ocr-fra \
     tesseract-ocr-ara \
-    # Add other languages if needed, e.g., tesseract-ocr-all for all languages
-    # If you remove apt_packages from requirements.txt, ensure these are here.
+    # Add other languages if needed, e.g., tesseract-ocr-ara tesseract-ocr-fra
     && rm -rf /var/lib/apt/lists/*
 
 # Copy requirements.txt and install Python dependencies
-COPY requirements.txt .
+COPY --chown=user:user requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
+# Clean up any old Hugging Face Hub lock files before copying the application code.
+# This helps prevent PermissionErrors if a previous download attempt was interrupted.
+RUN rm -rf "${HF_HOME}/hub/tmp"
+RUN find "${HF_HOME}/hub/models--" -name "*.lock" -type f -delete || true
+
 # Copy the rest of your application code
-# This copies app.py, the src/ folder, and the documents/ folder.
-COPY . .
+COPY --chown=user:user . /app
 
-# Set the environment variable for Tesseract if it's not in the default path
-# This might be needed if Tesseract's executable isn't directly on PATH inside the container.
-# Tesseract is often installed to /usr/bin/tesseract or similar in Linux containers.
-# It's good practice to explicitly tell pytesseract where to find it.
+# Set environment variables for Tesseract and potentially for Python's sqlite3 module
 ENV TESSDATA_PREFIX=/usr/share/tesseract-ocr/4.00/tessdata
 ENV TESSERACT_CMD=/usr/bin/tesseract
+ENV PYTHON_IS_PYTESSERACT_ONLY=true
 
 # Command to run your FastAPI application using Uvicorn
-# 0.0.0.0 makes it accessible from outside the container
-# 7860 is the default port Hugging Face Spaces expects for web applications
 CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860"]