Update Dockerfile

Dockerfile

@@ -1,40 +1,63 @@
 # 使用官方Python 3.10 slim镜像
 FROM python:3.10-slim
 
-# --- 安装系统依赖 ---
+# --- 1. 安装系统依赖 ---
 RUN apt-get update && apt-get install -y --no-install-recommends \
     git \
+    git-lfs \
+    build-essential \
+    libgomp1 \
     curl \
     && rm -rf /var/lib/apt/lists/*
 
-# --- 设置工作目录 ---
-WORKDIR /app
-
-# --- 克隆代码仓库 ---
-ARG GH_USER
-ARG GH_TOKEN
-RUN git clone https://${GH_USER}:${GH_TOKEN}@github.com/leoncool23/tcm_expert_builder.git . && \
-    ls -la
-
-# --- 安装Python依赖 ---
+# --- 2. 设置工作目录 ---
+WORKDIR /src
+
+# --- 3. Git LFS初始化 ---
+RUN git lfs install
+
+# --- 4. 关键步骤：克隆私有仓库 ---
+# 保持你原有的secrets挂载方式，但添加调试和错误处理
+RUN --mount=type=secret,id=GH_USER \
+    --mount=type=secret,id=GH_TOKEN \
+    echo "Checking secrets..." && \
+    ls -la /run/secrets/ && \
+    GH_USER=$(cat /run/secrets/GH_USER) && \
+    GH_TOKEN=$(cat /run/secrets/GH_TOKEN) && \
+    echo "User: ${GH_USER}" && \
+    echo "Starting git clone..." && \
+    git clone https://${GH_USER}:${GH_TOKEN}@github.com/leoncool23/tcm_expert_builder.git && \
+    echo "Clone completed successfully" && \
+    ls -la tcm_expert_builder/
+
+# --- 5. 切换到项目目录 ---
+WORKDIR /src/tcm_expert_builder
+
+# --- 6. 验证关键文件存在 ---
+RUN echo "Current directory:" && pwd && \
+    echo "Directory contents:" && ls -la && \
+    echo "Checking requirements.txt:" && cat requirements.txt
+
+# --- 7. 安装Python依赖 ---
 RUN pip install --no-cache-dir --upgrade pip && \
     pip install --no-cache-dir -r requirements.txt
 
-# --- 配置环境变量 ---
+# --- 8. 配置NLTK和ChromaDB环境 ---
 ENV NLTK_DATA=/usr/local/share/nltk_data
 ENV ANONYMIZED_TELEMETRY=false
+RUN python -m nltk.downloader -d $NLTK_DATA punkt stopwords || \
+    python -c "import nltk; nltk.download('punkt'); nltk.download('stopwords')"
 
-# --- 下载NLTK数据 ---
-RUN python -c "import nltk; nltk.download('punkt'); nltk.download('stopwords')"
-
-# --- 创建必要目录 ---
-RUN mkdir -p uploads data/vector_db data
+# --- 9. 创建用户和设置权限 ---
+RUN useradd --create-home --shell /bin/bash appuser
+RUN chown -R appuser:appuser /src
 
-# --- 添加健康检查端点到你的Flask应用 ---
-# 在app.py中添加: @app.route('/health') def health(): return {'status': 'ok'}
+# --- 10. 以appuser身份创建目录 ---
+USER appuser
+RUN mkdir -p ./uploads ./data/vector_db ./data
 
-# --- 暴露端口 ---
+# --- 11. 暴露端口 ---
 EXPOSE 7860
 
-# --- 启动应用 ---
-CMD ["python", "app.py"]
+# --- 12. 启动应用（保持你原有的gunicorn方式，但添加更多日志） ---
+CMD ["gunicorn", "--workers", "1", "--bind", "0.0.0.0:7860", "--timeout", "120", "--log-level", "debug", "--access-logfile", "-", "--error-logfile", "-", "app:app"]