FROM python:3.13-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PORT=7860 \
    MEDIA_TMP_DIR=/tmp/filebot-media \
    SESSION_DIR=/app/data/session

RUN apt-get update \
 && apt-get install -y --no-install-recommends ffmpeg ca-certificates \
 && rm -rf /var/lib/apt/lists/*

# Non-root user (Hugging Face Spaces runs containers as uid 1000)
RUN useradd -m -u 1000 app

WORKDIR /app
COPY requirements.txt .
RUN pip install -r requirements.txt

COPY --chown=app:app app ./app
COPY --chown=app:app public ./public

RUN mkdir -p /app/data/session /tmp/filebot-media && chown -R app:app /app/data /tmp/filebot-media
USER app

EXPOSE 7860
CMD uvicorn app.main:app --host 0.0.0.0 --port ${PORT} --proxy-headers --forwarded-allow-ips='*'