Dockerfile

# Use an official Python runtime as a parent image
FROM python:3.10-slim

# Create a non-root user and group to run the application
RUN groupadd -r appuser && useradd -r -g appuser -m appuser

# Set environment variables for caching in a writable directory and for Python's module path
ENV HF_HOME="/home/appuser/.cache"
ENV PYTHONPATH="/app"

# Install system dependencies as root
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    ffmpeg \
    libsm6 \
    libxext6 \
    && rm -rf /var/lib/apt/lists/*

# Set the working directory
WORKDIR /app

# Copy and install Python dependencies as root
COPY ./requirements.txt /app/requirements.txt
RUN pip install --no-cache-dir --upgrade pip
RUN pip install --no-cache-dir -r requirements.txt gunicorn gevent

# Copy the application code and set ownership to the non-root user
COPY --chown=appuser:appuser . /app/

# Switch to the non-root user
USER appuser

# Expose the port the app runs on
EXPOSE 7860

# Command to run the application using Gunicorn
CMD ["gunicorn", "--bind", "0.0.0.0:7860", "--workers", "4", "--worker-class", "gevent", "--timeout", "600", "app:app"]