| FROM python:3.11-slim | |
| WORKDIR /app | |
| # Install system dependencies | |
| RUN apt-get update && apt-get install -y --no-install-recommends \ | |
| build-essential \ | |
| && rm -rf /var/lib/apt/lists/* | |
| # Copy requirements first for layer caching | |
| COPY requirements.txt . | |
| RUN pip install --no-cache-dir -r requirements.txt | |
| # Copy application code and data | |
| COPY app/ ./app/ | |
| COPY data/ ./data/ | |
| # NOTE: .env is intentionally NOT copied into the image — baking secrets into a | |
| # Docker image leaks them into every layer/cache and anyone with the image. | |
| # Pass the key at runtime instead: `docker run --env-file .env ...` (see README). | |
| # Expose port | |
| EXPOSE 8000 | |
| # Run with uvicorn | |
| CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "1"] | |