Dockerfile

FROM python:3.11-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

# System deps you actually use
RUN apt-get update && apt-get install -y --no-install-recommends \
    tesseract-ocr ffmpeg && \
    rm -rf /var/lib/apt/lists/*

# Writable dirs + non-root
RUN useradd -m appuser && mkdir -p /app /data/cache && chown -R appuser:appuser /app /data
WORKDIR /app

# Python deps
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt

# Hugging Face caches in /data (NOT /.cache)
ENV HF_HOME=/data/cache/huggingface \
    TRANSFORMERS_CACHE=/data/cache/huggingface/hub \
    SENTENCE_TRANSFORMERS_HOME=/data/cache/sentence-transformers \
    XDG_CACHE_HOME=/data/cache

USER appuser

# Pre-cache the embed model (optional)
RUN python - <<'PY'
from sentence_transformers import SentenceTransformer
SentenceTransformer('intfloat/e5-small-v2')
print('✅ cached e5-small-v2')
PY

# App code
COPY . ./

ENV PORT=7860
CMD ["bash","-lc","gunicorn -w 1 -k gthread --threads 8 -b 0.0.0.0:$PORT main:app"]