Update Dockerfile

Dockerfile

@@ -2,11 +2,12 @@
 # Base ships R + sf/GDAL/GEOS/PROJ (the slowest deps to build).
 FROM rocker/geospatial:4.4
 
-# DuckDB lives on the edgarodriguez/depth_alpha dataset; baked in at build.
-# Override with: docker build --build-arg DDB_URL=... -t depth-hf .
+# DuckDB lives on the edgarodriguez/depth_alpha dataset (public); baked in at
+# build. Override with: docker build --build-arg DDB_URL=... -t depth-hf .
+# If the dataset is ever made PRIVATE, add a build secret instead of an ARG:
+#   RUN --mount=type=secret,id=hf_token curl -H "Authorization: Bearer \
+#       $(cat /run/secrets/hf_token)" -fL "${DDB_URL}" -o /app/depth_mexico.duckdb
 ARG DDB_URL=https://huggingface.co/datasets/edgarodriguez/depth_alpha/resolve/main/depth_mexico.duckdb
-# For a PRIVATE dataset, also pass --build-arg HF_TOKEN=hf_xxx
-ARG HF_TOKEN=
 
 RUN install2.r --error --skipinstalled \
       shiny bslib DBI duckdb dplyr jsonlite htmltools glue writexl ggplot2 stringr \
@@ -17,8 +18,7 @@ WORKDIR /app
 COPY 10.11_draw_query_indicators_v10_HF.R helpers.R 10.08_styles.css ./
 
 # Bake the DuckDB into the image (build-time download).
-RUN if [ -n "$HF_TOKEN" ]; then AUTH="Authorization: Bearer $HF_TOKEN"; else AUTH=""; fi \
- && curl -fL ${AUTH:+-H "$AUTH"} "${DDB_URL}" -o /app/depth_mexico.duckdb \
+RUN curl -fL "${DDB_URL}" -o /app/depth_mexico.duckdb \
  && test -s /app/depth_mexico.duckdb \
  && ls -lh /app/depth_mexico.duckdb
 
@@ -30,3 +30,4 @@ ENV DEPTH_DDB_PATH=/app/depth_mexico.duckdb \
 
 EXPOSE 7860
 CMD ["Rscript", "10.11_draw_query_indicators_v10_HF.R"]
+