# M1 image — intentionally minimal (no torch / ffmpeg yet) so the first HF Spaces
# build is fast and reliable. M2 adds the ML stack + ffmpeg + baked fast weights.
FROM python:3.12-slim

# HF Spaces runs containers as a non-root user with UID 1000.
# Create /app owned by `user` BEFORE dropping privilege — otherwise Docker creates
# the WORKDIR root-owned and later writes (M2 weight baking) fail.
RUN useradd -m -u 1000 user && mkdir -p /app && chown user:user /app
USER user
ENV HOME=/home/user \
    PATH=/home/user/.local/bin:$PATH \
    PYTHONUNBUFFERED=1

WORKDIR /app

COPY --chown=user pyproject.toml README.md ./
COPY --chown=user app ./app
RUN pip install --no-cache-dir --user .

# Port 7860 must stay in lockstep with README `app_port` and Settings.port.
EXPOSE 7860
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860"]