feat(hf_token): set hf token during build

Dockerfile

@@ -1,8 +1,5 @@
 FROM python:3.12
 
-# Declare your environment variables with the ARG directive
-ARG HF_TOKEN
-
 RUN useradd -m -u 1000 user
 USER user
 ENV PATH="/home/user/.local/bin:$PATH"
@@ -14,12 +11,17 @@ RUN pip install --no-cache-dir -r requirements.txt --extra-index-url https://dow
 
 COPY --chown=user . /app
 
-
 # Download at build time,
 # to ensure during restart we won't have to wait for the download from HF (only wait for docker pull).
-RUN export HF_HOME=/app/.cache/huggingface
-RUN export HF_TOKEN=${HF_TOKEN}
-RUN python /app/download_model.py
+# In Docker Spaces, the secrets management is different for security reasons.
+# Once you create a secret in the Settings tab,
+# you can expose the secret by adding the following line in your Dockerfile:
+#
+# For example, if SECRET_EXAMPLE is the name of the secret you created in the Settings tab,
+# you can read it at build time by mounting it to a file, then reading it with $(cat /run/secrets/SECRET_EXAMPLE).
+# https://huggingface.co/docs/hub/en/spaces-sdks-docker#buildtime
+RUN --mount=type=secret,id=HF_TOKEN,mode=0444,required=true \
+    HF_TOKEN=$(cat /run/secrets/HF_TOKEN) python /app/download_model.py
 
 EXPOSE 7860
 

download_model.py

@@ -2,6 +2,9 @@ import os
 from huggingface_hub import snapshot_download
 
 hf_token: str = os.getenv("HF_TOKEN")
+if hf_token is None:
+    raise ValueError("HF_TOKEN is not set")
+
 hf_token = hf_token.strip()
 if hf_token == "":
     raise ValueError("HF_TOKEN is empty")