Dockerfile

# Use an official Node.js runtime as a parent image
FROM node:22-alpine

# Set the working directory in the container
WORKDIR /app

# --- Build-time Arguments ---
# Declare arguments that we will pass during the build command.
# This makes the API key and other secrets available during the build process.
ARG GEMINI_API_KEY
ARG EMAIL_USER
ARG EMAIL_PASS

# Copy package.json and package-lock.json
COPY package*.json ./

# Install app dependencies
RUN npm install

# Copy the rest of the application's source code
COPY . .

# Expose the port the app runs on
EXPOSE 7860

# --- Build Step ---
# Set environment variables from the build arguments we declared earlier.
# The `npm run build` command will now be able to access these keys.
RUN env GEMINI_API_KEY=$GEMINI_API_KEY EMAIL_USER=$EMAIL_USER EMAIL_PASS=$EMAIL_PASS npm run build

# Change ownership of the app directory to the 'node' user for better security
RUN chown -R node:node /app

# Switch to the non-root 'node' user
USER node

# --- Runtime Command ---
# Define the command to run your app.
# The secrets will ALSO need to be available here if your app uses them at runtime.
# Hugging Face injects the runtime secrets automatically.
CMD ["npm", "run", "dev"]