Dockerfile

# ──────────────────────────────────────────────────────────────────────
# VGTC Compliance API — Hugging Face Spaces Dockerfile
# ──────────────────────────────────────────────────────────────────────

FROM python:3.11-slim AS builder

SHELL ["/bin/bash", "-o", "pipefail", "-e", "-u", "-x", "-c"]

RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential curl ca-certificates && rm -rf /var/lib/apt/lists/*

RUN pip install --no-cache-dir uv==0.4.10

WORKDIR /app
COPY pyproject.toml README.md ./
COPY src/ src/

RUN uv venv /opt/vgtc \
    && . /opt/vgtc/bin/activate \
    && uv pip install --no-cache-dir --compile-bytecode "hatchling>=1.21,<2" \
    && uv pip install --no-cache-dir --compile-bytecode .


# ══════════════════════════════════════════════════════════════════════
# Stage 2: Production
# ══════════════════════════════════════════════════════════════════════
FROM python:3.11-slim AS production

SHELL ["/bin/bash", "-o", "pipefail", "-e", "-u", "-c"]

RUN apt-get update && apt-get install -y --no-install-recommends \
    curl ca-certificates tini && rm -rf /var/lib/apt/lists/*

# Hugging Face requires user with UID 1000
RUN useradd -m -u 1000 user \
    && mkdir -p /app/data /app/logs /app/cache /home/user/.cache/hermes/sanctions \
    && chown -R user:user /app /home/user

COPY --from=builder --chown=user:user /opt/vgtc /opt/vgtc
COPY --chown=user:user src/ src/
COPY --chown=user:user pyproject.toml ./

ENV PATH="/opt/vgtc/bin:${PATH}" \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PYTHONHASHSEED=random \
    HOME=/home/user \
    HERMES_ENVIRONMENT=production \
    SECURITY_ENABLE_AUTH=false

USER user
WORKDIR /app

# Pre-bake Sanctions Data to avoid cold start downloads!
RUN python -c "from hermes.tools.sanctions import get_engine; print('Pre-baking Sanctions Data...'); get_engine(); print('Done!')"

EXPOSE 7860

HEALTHCHECK --interval=30s --timeout=10s --retries=5 --start-period=60s \
    CMD curl -sf http://localhost:7860/docs || exit 1

ENTRYPOINT ["tini", "--"]
CMD ["sh", "-c", "uvicorn hermes.api.server:server --host 0.0.0.0 --port 7860 --workers 2 --loop uvloop --http httptools --log-level info --access-log --proxy-headers --forwarded-allow-ips '*'"]