Dockerfile

# =========================================================
# CivicConnect — Flask AI Engine
# Deploy target: Hugging Face Spaces (Docker SDK)
# =========================================================

FROM python:3.11-slim

# ── System dependencies ───────────────────────────────────
RUN apt-get update && apt-get install -y --no-install-recommends \
    ffmpeg \
    libsndfile1 \
    libgl1 \
    libglib2.0-0 \
    libgomp1 \
    git \
    curl \
 && rm -rf /var/lib/apt/lists/*

# ── Create non-root user (HF Spaces requirement) ─────────
RUN useradd -m -u 1000 appuser

# ── Set working directory inside user home ────────────────
# MUST be under /home/appuser — fixes "No module named main"
WORKDIR /home/appuser/app

# ── Copy requirements first (layer cache) ────────────────
COPY requirements.txt .

# ── Install Python dependencies ───────────────────────────
RUN pip install --no-cache-dir --upgrade pip \
 && pip install --no-cache-dir -r requirements.txt

# ── Copy application source ───────────────────────────────
COPY --chown=appuser:appuser . .

# ── Environment defaults (overridden by HF Secrets) ──────
ENV PORT=7860
ENV PYTHONUNBUFFERED=1
ENV HF_HOME=/home/appuser/.cache/huggingface

# ── Switch to non-root user ───────────────────────────────
USER appuser

EXPOSE 7860

HEALTHCHECK --interval=60s --timeout=10s --start-period=120s --retries=3 \
    CMD curl -f http://localhost:7860/ || exit 1

# --worker-tmp-dir /tmp  → fixes "Permission denied" on gunicorn control socket
# --chdir               → ensures main.py is found at cwd
CMD ["gunicorn", \
     "--bind", "0.0.0.0:7860", \
     "--workers", "1", \
     "--timeout", "600", \
     "--keep-alive", "5", \
     "--worker-tmp-dir", "/tmp", \
     "--chdir", "/home/appuser/app", \
     "--log-level", "info", \
     "--access-logfile", "-", \
     "--error-logfile", "-", \
     "app:app"]