Dockerfile

# ---------------------------------------------------------------
# CRITICAL CHANGE: Use the FULL Python image (not slim).
# The 'slim' image lacks the C-level SSL libraries required
# by the Azure Speech SDK to initialize its platform.
# ---------------------------------------------------------------
FROM python:3.10

# 1. Install System Dependencies
# + curl so we can pull libssl1.1 manually
RUN apt-get update && apt-get install -y \
    build-essential \
    libgl1 \
    libasound2 \
    libssl-dev \
    ca-certificates \
    ffmpeg \
    curl \
    && rm -rf /var/lib/apt/lists/*

# 1b. Install libssl1.1 (Azure Speech SDK still wants this on Debian-based images)
# Source: Debian pool; works for bookworm too.
RUN export arch=$(dpkg --print-architecture) \
 && curl -sSLo /tmp/libssl1.1.deb \
      "https://deb.debian.org/debian/pool/main/o/openssl/libssl1.1_1.1.1w-0+deb11u1_${arch}.deb" \
 && dpkg -i /tmp/libssl1.1.deb \
 && rm /tmp/libssl1.1.deb

# 2. Force update of security certificates
RUN update-ca-certificates

# 3. Setup Work Directory
WORKDIR /app

# 4. Install Python Dependencies
COPY requirements.txt .

# Make sure we’re on a recent Speech SDK
RUN pip install --no-cache-dir -r requirements.txt \
    && pip install --no-cache-dir --upgrade \
       "azure-cognitiveservices-speech>=1.46.0" "azure-core>=1.36.0"

# 5. Copy Server Code
COPY . .

# 6. Security: Create non-root user (Mandatory for HF Spaces)
RUN useradd -m -u 1000 user
USER user
ENV HOME=/home/user \
    PATH=/home/user/.local/bin:$PATH

# 7. Expose the specific HF port
EXPOSE 7860

# 8. Start Command
CMD ["gunicorn", "--worker-class", "eventlet", "-w", "1", "--bind", "0.0.0.0:7860", "app:app"]