Dockerfile

# API-only Space image: same backend/agent as the main Space. Documentation is
# served from huggingface/ml-intern-api-docs so docs-only changes do not rebuild
# or restart this API server.
FROM python:3.12-slim

# Install uv directly from official image
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/

# Create user with UID 1000 (required for HF Spaces)
RUN useradd -m -u 1000 user

WORKDIR /app

# Install system dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    git \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Copy dependency files
COPY pyproject.toml uv.lock ./

# Install dependencies into /app/.venv
# Use --frozen to ensure exact versions from uv.lock
RUN uv sync --no-dev --frozen

# Copy application code
COPY agent/ ./agent/
COPY backend/ ./backend/
COPY configs/ ./configs/

# Create directories and set ownership
RUN mkdir -p /app/session_logs && \
    chown -R user:user /app

# Switch to non-root user
USER user

# Set environment. REQUIRE_API_AUTH: this Space has no HF OAuth app, so force
# Bearer-token auth on — without it the backend would fall back to the
# dev-mode identity and act as the server's own HF_TOKEN for every caller.
ENV HOME=/home/user \
    PYTHONUNBUFFERED=1 \
    PYTHONPATH=/app \
    PATH="/app/.venv/bin:$PATH" \
    REQUIRE_API_AUTH=1

# Expose port
EXPOSE 7860

# Run the application from backend directory
WORKDIR /app/backend
CMD ["bash", "start.sh"]