Dockerfile

# Serving image for the codLLM historian app.
#
# Built for Hugging Face Spaces (sdk: docker), but it is a plain container and
# runs anywhere: docker run -p 7860:7860 -e CODLLM_PASSWORD=... codllm
#
# The image does NOT carry the model weights. They are pulled from the Hub at
# first start via CODLLM_CKPT, which keeps the image small and lets the model be
# updated without rebuilding. The ICD-10h masterlist IS copied in: it is 2.3 MB
# and the app cannot render a single code description without it.

FROM python:3.13-slim

# Spaces runs the container as uid 1000; matching it avoids permission surprises
# on the HF cache directory.
RUN useradd -m -u 1000 user
USER user
ENV HOME=/home/user \
    PATH=/home/user/.local/bin:$PATH
WORKDIR $HOME/app

# Dependencies first so edits to the app do not invalidate the pip layer.
COPY --chown=user deploy/requirements.txt ./requirements.txt
RUN pip install --no-cache-dir --upgrade pip && \
    pip install --no-cache-dir -r requirements.txt

COPY --chown=user demo/ ./demo/

# The masterlist is NOT baked in. It is pulled at run time from the private model
# repo via CODLLM_MASTERLIST_REPO + HF_TOKEN, so this image can be public without
# redistributing the dataset.
ENV CODLLM_HOST=0.0.0.0 \
    CODLLM_PORT=7860 \
    CODLLM_NO_WINDOW=1 \
    CODLLM_BATCH=32 \
    HF_HOME=/home/user/.cache/huggingface \
    PYTHONUNBUFFERED=1

# Required at run time, no default on purpose:
#   CODLLM_CKPT       Hub repo id of the model, e.g. you/codllm-base-deploy
#   CODLLM_PASSWORD   the server refuses to bind 0.0.0.0 without it,
#                     unless CODLLM_OPEN=1 says to run with no password
# Optional:
#   HF_TOKEN          only if the model repo is private

EXPOSE 7860

# Cheap liveness signal; /healthz needs no auth and reports load progress.
HEALTHCHECK --interval=30s --timeout=5s --start-period=300s --retries=3 \
    CMD python -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:7860/healthz',timeout=4).status==200 else 1)"

CMD ["python", "demo/serve.py"]