FROM python:3.11-slim

WORKDIR /code

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY app ./app
COPY data ./data

# Run as a non-root user: no vulnerability in this app relies on root today,
# but a future RCE-class bug in a dependency (fastapi/starlette/uvicorn/
# sqlalchemy) should be confined to a low-privilege account rather than
# handed root inside the container for free.
RUN useradd -m -u 1000 appuser && chown -R appuser:appuser /code
USER appuser

# Hugging Face Spaces' Docker SDK expects the app on port 7860.
# Hugging Face persistent storage is mounted at /data. Study audio is uploaded
# there through the authenticated admin endpoint and never copied into the
# public Space repository.
ENV ANNOTATOR_DB_PATH=/data/annotator.db
ENV ANNOTATOR_MEDIA_DIR=/data/study_clips
ENV REQUIRE_ACCESS_CODE=true
ENV STUDY_PHASE=development
ENV STUDY_OPEN=false
EXPOSE 7860

CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860"]