# Use the official lightweight Python base image
FROM python:3.11-slim

# Set up the default Hugging Face non-root user (UID 1000)
RUN useradd -m -u 1000 user
ENV HOME=/home/user \
    PATH=/home/user/.local/bin:$PATH \
    HERMES_HOME=/home/user/.hermes

WORKDIR /home/user

# Install critical system tools for extracting packages and cloning repositories
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl \
    ca-certificates \
    git \
    xz-utils \
    && rm -rf /var/lib/apt/lists/*

# Switch to the non-root user context required by Hugging Face
USER user

# Install the official hermes-agent with web dashboard dependencies
RUN pip install --no-cache-dir 'hermes-agent[web,pty]'

# Force the web dashboard to build its assets inside user-space if missing
RUN python -m hermes_cli.main doctor || true

# Set up default environment variables for Hugging Face matching port 7860
ENV PORT=7860

# Expose Hugging Face's default port
EXPOSE 7860

# Launch the unified dashboard.
# --insecure is required here to allow binding to 0.0.0.0 without a custom OAuth plugin.
CMD ["python", "-m", "hermes_cli.main", "dashboard", "--host", "0.0.0.0", "--port", "7860", "--no-open", "--insecure"]