Dockerfile

FROM python:3.10-slim

# Install system dependencies
RUN apt-get update && apt-get install -y \
    git \
    ffmpeg \
    libsndfile1 \
    && rm -rf /var/lib/apt/lists/*

# Set working directory
WORKDIR /app

# Create a non-root user with a dedicated home directory
RUN addgroup --system app && adduser --system --group --home /home/app app

# Create cache directories with proper permissions
RUN mkdir -p /home/app/.cache/huggingface \
    /home/app/.cache/matplotlib \
    /home/app/.cache/torch \
    && chown -R app:app /home/app

# Copy requirements first for better caching
COPY requirements.txt .
RUN chown app:app requirements.txt

# Switch to the non-root user early
USER app

# Set environment variables to use user's home directory for caches
ENV HF_HOME=/home/app/.cache/huggingface
ENV HF_HUB_CACHE=/home/app/.cache/huggingface
ENV TRANSFORMERS_CACHE=/home/app/.cache/huggingface
ENV MPLCONFIGDIR=/home/app/.cache/matplotlib
ENV TORCH_HOME=/home/app/.cache/torch
ENV PATH="/home/app/.local/bin:${PATH}"

# Install Python packages as the 'app' user
RUN pip install --user --upgrade pip
RUN pip install --user --no-cache-dir torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cpu
RUN pip install --user --no-cache-dir git+https://github.com/pyannote/pyannote-audio.git
RUN pip install --user --no-cache-dir -r requirements.txt

# Copy source code and set ownership
COPY --chown=app:app . .

# Pre-download models to avoid runtime permission issues (optional)
# RUN python -c "from transformers import pipeline; pipeline('summarization', model='facebook/bart-large-cnn')"
# RUN python -c "from faster_whisper import WhisperModel; WhisperModel('tiny')"

# Expose the application port
EXPOSE 7860

# Run the FastAPI app
CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860"]