Rebuild image on python:3.11-slim with isolated venvs

The searxng/searxng base image no longer ships a searx-pyenv virtualenv
(2026.7.1 runs granian and installs searx elsewhere), which broke the build.
Switch to a controllable python:3.11-slim base and install SearXNG from
source into /opt/searxng-venv and the Gradio app into /opt/appenv, so the
two dependency sets stay isolated. start.sh now drives each venv explicitly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Dockerfile

@@ -1,48 +1,53 @@
 # Blog Post Generator — HF Docker Space
-# Bundles a self-hosted SearXNG (internal, 127.0.0.1:8080) + a Gradio app (public, 7860).
-FROM searxng/searxng:latest
-
-USER root
-
-# --- system deps for trafilatura/lxml/Pillow (Alpine base) ---
-RUN apk add --no-cache \
-        bash \
-        libxml2 \
-        libxslt \
-        jpeg \
-        zlib \
-        build-base \
-        libxml2-dev \
-        libxslt-dev \
-        jpeg-dev \
-        zlib-dev
-
-# SearXNG installs into this virtualenv; reuse it for the app so we get one Python.
-ENV VENV=/usr/local/searxng/searx-pyenv
-ENV PATH="$VENV/bin:$PATH"
-ENV SEARXNG_SETTINGS_PATH=/etc/searxng/settings.yml
-# HF persistent storage mounts at /data; config.py falls back if absent.
-ENV DATA_DIR=/data
-ENV SEARXNG_URL=http://127.0.0.1:8080
-
+# One container, two isolated virtualenvs:
+#   /opt/searxng-venv  → SearXNG (internal metasearch on 127.0.0.1:8080)
+#   /opt/appenv        → the Gradio app (public on 7860)
+# Keeping them separate avoids dependency conflicts between SearXNG and Gradio.
+FROM python:3.11-slim
+
+ENV PIP_NO_CACHE_DIR=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PYTHONUNBUFFERED=1 \
+    SEARXNG_SETTINGS_PATH=/etc/searxng/settings.yml \
+    SEARXNG_URL=http://127.0.0.1:8080 \
+    DATA_DIR=/data \
+    HOME=/app
+
+# --- system deps: build tools + libs for lxml/trafilatura/Pillow, git for SearXNG source ---
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        bash git build-essential \
+        libxml2-dev libxslt1-dev zlib1g-dev libffi-dev libssl-dev \
+        libjpeg62-turbo-dev \
+        ca-certificates curl \
+    && rm -rf /var/lib/apt/lists/*
+
+# --- SearXNG (from source) into its own venv ---
+ARG SEARXNG_REF=master
+RUN git clone --depth 1 --branch "$SEARXNG_REF" https://github.com/searxng/searxng.git /usr/local/searxng
+RUN python -m venv /opt/searxng-venv \
+    && /opt/searxng-venv/bin/pip install -U pip setuptools wheel pyyaml msgspec typing-extensions pybind11 \
+    && /opt/searxng-venv/bin/pip install --use-pep517 -e /usr/local/searxng
+
+# --- Gradio app into its own venv ---
+RUN python -m venv /opt/appenv
+COPY requirements.txt /app/requirements.txt
+RUN /opt/appenv/bin/pip install -U pip \
+    && /opt/appenv/bin/pip install -r /app/requirements.txt
+
+# --- app source + SearXNG config ---
 WORKDIR /app
-
-COPY requirements.txt .
-RUN "$VENV/bin/pip" install --no-cache-dir -r requirements.txt
-
-# App source
-COPY app.py start.sh ./
-COPY pipeline ./pipeline
+COPY app.py start.sh /app/
+COPY pipeline /app/pipeline
 COPY searxng/settings.yml /etc/searxng/settings.yml
 
 # HF Spaces run the container as UID 1000 — make everything that gets written writable.
 RUN chmod +x /app/start.sh \
-    && mkdir -p /data /app/.cache \
-    && chgrp -R 0 /app /etc/searxng /usr/local/searxng /data \
-    && chmod -R g+rwX /app /etc/searxng /usr/local/searxng /data
+    && mkdir -p /data /app/.cache /var/cache/searxng \
+    && useradd -m -u 1000 user || true \
+    && chown -R 1000:1000 /app /etc/searxng /data /var/cache/searxng /usr/local/searxng \
+    && chmod -R u+rwX /app /etc/searxng /data /var/cache/searxng
 
 EXPOSE 7860
-
 USER 1000
 
 ENTRYPOINT ["/app/start.sh"]

start.sh

@@ -1,8 +1,11 @@
 #!/usr/bin/env bash
 # Launch SearXNG (internal) then the Gradio app (public). SearXNG runs in the
 # background bound to 127.0.0.1:8080; the app talks to it over localhost.
+# Each process uses its own isolated virtualenv.
 set -euo pipefail
 
+SEARXNG_PY=/opt/searxng-venv/bin/python
+APP_PY=/opt/appenv/bin/python
 SEARXNG_HOST="127.0.0.1"
 SEARXNG_PORT="8080"
 
@@ -10,18 +13,17 @@ SEARXNG_PORT="8080"
 # placeholder, generate one at runtime (settings dir is made writable in the image).
 SETTINGS="${SEARXNG_SETTINGS_PATH:-/etc/searxng/settings.yml}"
 if grep -q 'ultrasecretkey_change_me' "$SETTINGS" 2>/dev/null; then
-    KEY="$(python -c 'import secrets; print(secrets.token_hex(32))')"
-    # portable in-place edit (BusyBox sed supports -i)
+    KEY="$("$APP_PY" -c 'import secrets; print(secrets.token_hex(32))')"
     sed -i "s/ultrasecretkey_change_me/${KEY}/" "$SETTINGS" || true
 fi
 
 echo "[start] launching SearXNG on ${SEARXNG_HOST}:${SEARXNG_PORT} ..."
-python -m searx.webapp &
+"$SEARXNG_PY" -m searx.webapp &
 SEARXNG_PID=$!
 
-# Wait for SearXNG to answer before starting the app (max ~30s).
-for i in $(seq 1 30); do
-    if python - <<'PY' 2>/dev/null; then
+# Wait for SearXNG to accept connections before starting the app (max ~40s).
+for i in $(seq 1 40); do
+    if "$APP_PY" - <<'PY' 2>/dev/null; then
 import socket, sys
 s = socket.socket()
 s.settimeout(1)
@@ -37,12 +39,12 @@ PY
         break
     fi
     if ! kill -0 "$SEARXNG_PID" 2>/dev/null; then
-        echo "[start] SearXNG process exited early; continuing (search will be degraded)."
+        echo "[start] WARNING: SearXNG process exited early; search will be degraded."
         break
     fi
-    echo "[start] waiting for SearXNG ($i/30) ..."
+    echo "[start] waiting for SearXNG ($i/40) ..."
     sleep 1
 done
 
 echo "[start] launching Gradio app on 0.0.0.0:7860 ..."
-exec python /app/app.py
+exec "$APP_PY" /app/app.py