Update Dockerfile

Dockerfile

@@ -1,21 +1,41 @@
+# Dockerfile
+# Minimal, explicit CPU PaddlePaddle + PaddleOCR install for HuggingFace Space.
+# Installs packages via pip (no requirements.txt), uses non-root runtime user.
 FROM python:3.10-slim
 
-RUN apt-get update && apt-get install -y \
-    libgomp1 \
-    libstdc++6 \
-    poppler-utils \
+# Create a non-root user for least-privilege execution
+ARG USERNAME=appuser
+RUN groupadd -r ${USERNAME} && useradd -r -g ${USERNAME} ${USERNAME}
+
+# System dependencies required by Pillow / PyMuPDF and common Linux libs
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    libgl1 \
     libglib2.0-0 \
     libsm6 \
     libxrender1 \
     libxext6 \
-    && apt-get clean
+    git \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
 
-COPY requirements.txt /app/requirements.txt
-RUN pip install --no-cache-dir -r /app/requirements.txt
+WORKDIR /app
 
+# Copy application code (expecting app.py at build time)
 COPY app.py /app/app.py
-WORKDIR /app
 
-EXPOSE 7860
+# Install Python dependencies via pip directly inside Dockerfile (no requirements.txt)
+# The two lines below match user's requested commands for paddlepaddle and paddleocr (CPU).
+RUN pip install --upgrade pip setuptools wheel \
+ && pip install fastapi uvicorn python-multipart pydantic Pillow PyMuPDF \
+ && pip install paddlepaddle==3.0.0 \
+ && python -m pip install paddleocr
+
+# Expose port used by uvicorn
+EXPOSE 8000
+
+# Switch to non-root user
+USER ${USERNAME}
 
-CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860"]
+# Entrypoint - run uvicorn for the FastAPI app
+CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "1"]