Dockerfile

# Use an official Python runtime as a parent image
FROM python:3.10-slim AS base
ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    # Constrain BLAS/parallel libs to avoid excess threads on small CPU
    OMP_NUM_THREADS=1 \
    OPENBLAS_NUM_THREADS=1 \
    MKL_NUM_THREADS=1 \
    NUMEXPR_NUM_THREADS=1 \
    TOKENIZERS_PARALLELISM=false \
    # ONNX Runtime threading limits (fallback if not explicitly set)
    ORT_INTRA_OP_NUM_THREADS=1 \
    ORT_INTER_OP_NUM_THREADS=1

WORKDIR /app

# Install build essentials only if needed for wheels (kept minimal)
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    procps \
    && rm -rf /var/lib/apt/lists/*

COPY constraints.txt requirements.txt ./
RUN python -m pip install --upgrade pip setuptools wheel \
    && pip install --no-cache-dir -r requirements.txt -c constraints.txt --only-binary=:all: || \
    pip install --no-cache-dir -r requirements.txt -c constraints.txt

# Application source
COPY app.py ./app.py
COPY templates ./templates
COPY static ./static
COPY src ./src
COPY synthetic_policies ./synthetic_policies
COPY data ./data
COPY scripts ./scripts
COPY run.sh ./run.sh
COPY gunicorn.conf.py ./gunicorn.conf.py

RUN chmod +x run.sh && chmod +x scripts/init_pgvector.py || true

EXPOSE 8080

# Run the app via Gunicorn binding to 0.0.0.0:8080. Use conservative workers/threads
# to reduce memory usage on small instances.
CMD ["gunicorn", "-b", "0.0.0.0:8080", "-w", "2", "--threads", "2", "src.app_factory:create_app()"]

# Optional dev stage for local tooling (not used in final image)
FROM base AS dev
COPY dev-requirements.txt ./dev-requirements.txt
RUN pip install --no-cache-dir -r dev-requirements.txt -c constraints.txt || true