Dockerfile

# ─────────────── Stage 1: build Python deps ───────────────
FROM python:3.10-slim AS builder

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

WORKDIR /app

# basic C / system libs for wheels that need compile
RUN apt-get update && apt-get install -y --no-install-recommends \
        build-essential libglib2.0-0 libsm6 libxrender1 libxext6 \
    && rm -rf /var/lib/apt/lists/*

COPY requirements.txt /
RUN pip install --upgrade pip \
 && pip install --no-cache-dir -r /requirements.txt

# download the small spaCy English model at build-time
RUN python -m spacy download en_core_web_sm

# ─────────────── Stage 2: runtime image ────────────────────
FROM python:3.10-slim

# ‼️  fix Streamlit "permission denied /.streamlit" issue
ENV STREAMLIT_DATA_DIR=/tmp/.streamlit \
    XDG_STATE_HOME=/tmp \
    STREAMLIT_BROWSER_GATHERUSAGESTATS=false

RUN mkdir -p /tmp/.streamlit

WORKDIR /app

RUN apt-get update && apt-get install -y --no-install-recommends \
        libglib2.0-0 libsm6 libxrender1 libxext6 \
    && rm -rf /var/lib/apt/lists/*

# copy installed libs from builder
COPY --from=builder /usr/local/lib/python3.10/site-packages /usr/local/lib/python3.10/site-packages
COPY --from=builder /usr/local/bin /usr/local/bin

# app source
COPY . /app

# non-root user for security
RUN groupadd -r appuser && useradd -r -g appuser appuser \
 && chown -R appuser:appuser /app
USER appuser

EXPOSE 7860

# Streamlit entry
ENTRYPOINT ["streamlit", "run", "app.py", "--server.address=0.0.0.0", "--server.port=7860"]