Dockerfile

FROM python:3.12-slim

ENV PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    HF_HOME=/tmp/hf \
    FIREHOSE_DIR=/data

RUN useradd -m -u 1000 user
WORKDIR /home/user/app

# CPU-only torch for the ingest worker (GLiNER2.5-Decide); gliner2 pins transformers<5 / huggingface_hub<1.0.
COPY --chown=user requirements.txt .
RUN pip install --extra-index-url https://download.pytorch.org/whl/cpu -r requirements.txt

COPY --chown=user . .
USER user
EXPOSE 7860

# One Granian worker process: the app supervises the single ingest worker (single-writer rule for the bucket).
CMD ["granian", "--interface", "asgi", "--host", "0.0.0.0", "--port", "7860", "--workers", "1", \
     "--runtime-threads", "2", "app:app"]