Dockerfile

FROM python:3.9-slim

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    HF_HOME=/tmp/huggingface_cache \
    TRANSFORMERS_CACHE=/tmp/huggingface_cache/transformers \
    HF_DATASETS_CACHE=/tmp/huggingface_cache/datasets \
    TORCH_HOME=/tmp/torch_cache \
    TOKENIZERS_PARALLELISM=false \
    OMP_NUM_THREADS=1 \
    MKL_NUM_THREADS=1 \
    OPENBLAS_NUM_THREADS=1

# System deps
RUN apt-get update && apt-get install -y \
    ffmpeg \
    libavcodec-extra \
    espeak-ng \
    alsa-utils \
    libasound2-dev \
    libsndfile1 \
    cmake \
    build-essential \
    pkg-config \
    gcc \
    g++ \
    curl \
    wget \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

# Python deps
RUN pip install --upgrade pip setuptools wheel && \
    pip install --no-cache-dir sentencepiece && \
    pip install --no-cache-dir torch==2.0.1 torchaudio==2.0.2 \
        --index-url https://download.pytorch.org/whl/cpu

# Cache dirs
RUN mkdir -p $HF_HOME $TORCH_HOME && chmod -R 777 $HF_HOME $TORCH_HOME

WORKDIR /code
COPY requirements.txt .

RUN pip install --no-cache-dir -r requirements.txt && \
    pip cache purge && \
    rm -rf ~/.cache/pip /tmp/* /var/tmp/*

COPY . .

# Non-root user (HF best practice)
RUN useradd --create-home app && \
    chown -R app:app /code $HF_HOME $TORCH_HOME

USER app

EXPOSE 7860

HEALTHCHECK --interval=30s --timeout=30s --start-period=60s --retries=3 \
    CMD curl -f http://localhost:7860/health || exit 1

CMD ["python", "-u", "app.py"]