Deploy simready-assets run 20261020-a3cb7f2-captions (GPU variant)

Dockerfile

@@ -103,6 +103,9 @@ COPY docker/hf-space/siglip2-model/model_repo/siglip2_vision_encoder_onnx/config
 COPY docker/hf-space/siglip2-model/model_repo/siglip2_text_encoder_onnx/config.pbtxt /models/siglip2_text_encoder_onnx/config.pbtxt
 RUN mkdir -p /models/siglip2_vision_encoder_onnx/1 /models/siglip2_text_encoder_onnx/1
 COPY docker/hf-space/siglip2-model/model_repo/tokenizer /models/tokenizer
+# Owned by uid 1000: [program:siglip2-triton] restores the encoder weights into /models as that user. Some Space
+# hardware (rtx-pro-6000, 2026-10-21) runs the container as uid 1000 whatever USER says, so nothing may need root.
+RUN chown -R 1000:1000 /models
 
 # Python deps for the tokenizer + image_preprocessing Python-backend models —
 # resolved from pyproject.toml + uv.lock (the source of truth) at build time,
@@ -158,7 +161,12 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         redis-server supervisor nginx curl python3.12-venv openssl libssl3t64 \
     && rm -rf /var/lib/apt/lists/* \
     && pip install --no-cache-dir --upgrade virtualenv==21.14.5 \
-    && rm -f /etc/nginx/sites-enabled/default
+    && rm -f /etc/nginx/sites-enabled/default \
+    && sed -i 's|^pid .*|pid /tmp/nginx.pid;|' /etc/nginx/nginx.conf \
+    && chown -R 1000:1000 /etc/nginx/conf.d /var/lib/nginx /var/log/nginx
+# nginx runs as uid 1000 (supervisord-gpu.conf): the pid file moves to /tmp, and the rendered config, temp and log
+# dirs belong to that user. Some Space hardware (rtx-pro-6000, 2026-10-21) runs the container as uid 1000 whatever
+# USER says, and nginx with user=root never started there (supervisord: "Can't drop privilege as nonroot user").
 
 # The app venv: same /app/.venv path docker/Dockerfile.hf-space and
 # docker/hf-space/supervisord*.conf both hardcode. Installed from the same
@@ -401,7 +409,7 @@ ENV HF_STORAGE_API_TOKEN= \
     TRITON_SERVER_URL=localhost:8001 \
     SIGLIP2_TRITON_SERVER_SSL=false \
     # deepsearch-api processes, ONE uvicorn worker each, behind nginx's least_conn
-    # upstream (supervisord-gpu.conf, nginx.conf.template). 16 for l4x4 (48 vCPU):
+    # upstream (supervisord-gpu.conf, nginx.conf.template). 16 for l4x4 (48 vCPU), kept on rtx-pro-6000 (23 vCPU; not load-tested there yet):
     # 2026-10-20 lab, l4x4 shape, 32 checks each: 16 processes held p95 of all badges at
     # 3.2 s up to 240 users (6.3 s at 300, CPU-bound); 6 processes reached ~100 users
     # with the CPU under 30 %. On a10g-large (12 vCPU) use 6: 8 cost ~20 % more CPU there. Must equal supervisord-gpu.conf's

README.md

@@ -6,7 +6,7 @@ colorTo: blue
 sdk: docker
 app_port: 7860
 startup_duration_timeout: 1h
-hardware: l4x4
+hardware: rtx-pro-6000
 ---
 
 # SimReady Central USD Search
@@ -14,7 +14,7 @@ hardware: l4x4
 SimReady Central USD Search — single-container demo (OpenSearch + Neo4j +
 Redis + deepsearch-api + asset-graph-service, SigLIP2 embeddings via a local
 siglip2-triton process — see docker/Dockerfile.hf-space-gpu). Runs on a GPU
-hardware tier (l4x4), unlike the free-tier
+hardware tier (rtx-pro-6000), unlike the free-tier
 docker/Dockerfile.hf-space variant, which routes SigLIP2 to NVCF instead.
 The index itself is pulled from the artifact S3 bucket at container
 startup, not baked in. Deployed by

docker/hf-space/supervisord-gpu.conf

@@ -60,7 +60,8 @@ stderr_logfile_maxbytes=0
 ; image, same as every other backend.
 command=/bin/sh -c "cd /app/hf-space-pipeline && exec /app/.venv/bin/python -m pipeline.hf_space_seed --component=siglip2-model"
 directory=/app/hf-space-pipeline
-user=root
+; Not root: some Space hardware (rtx-pro-6000) runs the container as uid 1000, where user=root never starts.
+user=1000
 autorestart=true
 startsecs=10
 stdout_logfile=/dev/stdout
@@ -252,7 +253,8 @@ stderr_logfile_maxbytes=0
 ; a space before a ";" or "#" in a command: supervisord reads it as an inline
 ; comment and cuts the command there (2026-10-15: nginx FATAL on prod).
 command=/bin/sh -c "sh /usr/local/bin/media-gate.sh; n=${DEEPSEARCH_API_PROCESSES:-1}; ports=; ups=; i=1; while [ $i -le $n ]; do ports=\"$ports $((8100+i))\"; ups=\"$ups server 127.0.0.1:$((8100+i));\"; i=$((i+1)); done; t=0; until curl -sf http://localhost:8010/docs >/dev/null 2>&1 && { (for p in $ports; do curl -sf http://localhost:$p/health >/dev/null 2>&1 || exit 1; done) || { [ $t -ge 90 ] && (for p in $ports; do curl -sf http://localhost:$p/health >/dev/null 2>&1 && exit 0; done; exit 1); }; }; do sleep 2; t=$((t+2)); done; dl=false; case '%(ENV_DOWNLOAD_ENABLED)s' in [Tt]rue|1) if [ -f /app/hf-space-pipeline/.build/restore/hf-storage-api-catalog.yaml ]; then dl=true; else echo 'nginx: no hf-storage-api catalog, rendering download:false' >&2; fi;; esac; vf=glb; case $VIEWER_FORMAT in glb|usd|auto) vf=$VIEWER_FORMAT;; *) [ -z \"$VIEWER_FORMAT\" ] || echo 'nginx: VIEWER_FORMAT is not glb, usd or auto: rendering viewerFormat glb' >&2;; esac; sed -e 's/__PORT__/%(ENV_PORT)s/' -e 's|__CORPUS_NAME__|%(ENV_CORPUS_NAME)s|g' -e 's/__DOWNLOAD_ENABLED__/'$dl'/' -e 's|__SUBMIT_CONTENT_URL__|%(ENV_SUBMIT_CONTENT_URL)s|g' -e 's/__VIEWER_FORMAT__/'$vf'/' -e \"s/__DEEPSEARCH_API_SERVERS__/$ups/\" /etc/nginx/hf-space.conf.template > /etc/nginx/conf.d/hf-space.conf && exec nginx -g 'daemon off;'"
-user=root
+; Not root: some Space hardware (rtx-pro-6000) runs the container as uid 1000, where user=root never starts.
+user=1000
 autorestart=true
 startsecs=3
 stdout_logfile=/dev/stdout