Stop production native USD experiment and restore GLB for every interactive asset

Dockerfile

@@ -282,7 +282,7 @@ COPY docker/hf-space/search_fields.yaml /app/search_fields.yaml
 # own uvicorn; remapped to 8003 here).
 COPY docker/hf-space/supervisord-gpu.conf /etc/supervisor/conf.d/hf-space.conf
 
-COPY docker/hf-space/nginx.conf.template /etc/nginx/hf-space.conf.template
+COPY docker/hf-space/nginx-glb-production.conf.template /etc/nginx/hf-space.conf.template
 
 COPY services/explorer/dist /usr/share/nginx/explorer
 

docker/hf-space/nginx-glb-production.conf.template

@@ -0,0 +1,371 @@
+# Friendly external paths remapped to deepsearch-api's/asset-graph-service's
+# actual routes — same mapping as
+# usdsearch/helm/usdsearch/templates/api_gateway_config_map.yaml.
+# deepsearch-api listens on 127.0.0.1:8000, asset-graph-service on
+# 127.0.0.1:8010 (see docker/hf-space/supervisord.conf) — nginx is the sole
+# process bound to the externally proxied port, so it can front every route
+# with these rewrites plus CORS.
+#
+# The Explorer UI is served at `/` (root), not proxied to deepsearch-api at
+# all — served directly from the static bundle baked into this image at
+# build time (see the Dockerfile). Real difference from the multi-service
+# deployment, which proxies /ui and /static/ to a *separate*
+# deepsearch-explorer container: that bundle is just static files with
+# same-origin relative API calls (REACT_APP_API_URL baked empty) and its
+# own assets already use root-absolute paths (/static/js/..., /ds.png), so
+# serving it directly at `/` — where it already expects to live — needs no
+# extra process and no /ui prefix-stripping trick. The tradeoff: unlike the
+# old single catch-all proxy, deepsearch-api's own root-level routes
+# (/health, /docs, /redoc, /openapi.json) now need to be listed
+# explicitly below, since the final `location /` falls through to the SPA
+# instead. Also sidesteps a real problem seen live: a Space deployed with
+# `/` returning a 301 (redirecting to `/ui`, the previous approach) broke —
+# root cause not fully confirmed, but consistent with Hugging Face's own
+# readiness check wanting a real 200 at `/`, not a redirect.
+#
+# __PORT__ is substituted with $PORT at container start (supervisord.conf),
+# matching the Spaces convention of an operator-configurable app_port.
+
+# >>> simready-central slim explorer (http) >>>
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+# Included from nginx.conf's http{} (conf.d/*.conf) — an http-level directive is legal here.
+# ONE level under /tmp on purpose: nginx mkdir()s only the last path component (no mkdir -p), and
+# nothing in this image pre-creates a parent — /tmp/nginx-cache/slim-stats fails `nginx -t`. The
+# `levels=` subdirectories are different: nginx creates those itself on the first write.
+proxy_cache_path /tmp/slim-stats-cache levels=1 keys_zone=slim_stats_cache:2m max_size=256m inactive=1h use_temp_path=off;
+# Thumbnails (/images): ~1,500 JPEGs of 27-52 KB (~75 MB) fit well inside 1g. Lives in the container's
+# /tmp, so every deploy, restart or sleep starts it cold.
+proxy_cache_path /tmp/slim-images-cache levels=1:2 keys_zone=slim_images_cache:10m max_size=1g inactive=7d use_temp_path=off;
+# Library media (/library_media/ below): a file asked for under its ?v= (its content hash) never changes; the
+# manifest (no ?v=) revalidates, so a new fetch at the next container start shows at once.
+map $arg_v $slim_library_cache {
+    ""      "no-cache";
+    default "public, max-age=31536000, immutable";
+}
+# <<< simready-central slim explorer (http) <<<
+server {
+    listen __PORT__;
+
+    proxy_http_version 1.1;
+    proxy_set_header Connection "";
+    proxy_connect_timeout 5s;
+    proxy_send_timeout 60s;
+    proxy_read_timeout 60s;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    add_header Access-Control-Allow-Origin "*" always;
+    add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
+    add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
+
+    location /search {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/search(.*)$ /v2/deepsearch/search$1 break;
+        proxy_pass http://127.0.0.1:8000;
+    }
+
+    location /search_hybrid {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/search_hybrid(.*)$ /v3/deepsearch/search$1 break;
+        proxy_pass http://127.0.0.1:8000;
+    }
+
+    location /vlm_validate/search_result {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/vlm_validate/search_result(.*)$ /v3/deepsearch/vlm_validate/search_result$1 break;
+        proxy_pass http://127.0.0.1:8000;
+    }
+
+    location /llm_parse/ {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/llm_parse/(.*)$ /v3/deepsearch/llm_parse/$1 break;
+        proxy_pass http://127.0.0.1:8000;
+    }
+
+    # package-download (127.0.0.1:8020, pipeline/package_download/), not deepsearch-api: it answers
+    # /download/asset with the asset's whole SimReady package folder, same response contract, and
+    # forwards scope=dependencies (and anything outside a catalogued package) to deepsearch-api's
+    # own /v3/download/asset. It serves the /download/... paths itself, so no rewrite.
+    location /download {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        proxy_pass http://127.0.0.1:8020;
+        # Fetching a whole package (or a forwarded dependency bundle) can take longer than a single thumbnail.
+        proxy_read_timeout 300s;
+    }
+
+    location /images {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/images(.*)$ /v3/images$1 break;
+        proxy_pass http://127.0.0.1:8000;
+    }
+
+    location /static/ {
+        alias /usr/share/nginx/explorer/static/;
+    }
+
+    # asset-graph-service routes (query-time graph reads only — see
+    # docker/Dockerfile.hf-space's header for why there's no graph-builder/
+    # asset_graph_generation worker in this image). Same rewrites as the
+    # real gateway config's asset_graph_service locations, just proxying to
+    # our own internal port instead of a separate service/Space.
+    location /asset_graph/usd/scene_summary/ {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/asset_graph/usd/scene_summary/(.*)$ /asset_graph/usd/scene_summary/$1 break;
+        proxy_pass http://127.0.0.1:8010;
+    }
+
+    location /asset_graph/usd/scene_summary {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/asset_graph/usd/scene_summary(.*)$ /asset_graph/usd/scene_summary/$1 break;
+        proxy_pass http://127.0.0.1:8010;
+    }
+
+    location /asset_graph/usd/prims {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/asset_graph/usd/prims(.*)$ /asset_graph/usd/prims$1 break;
+        proxy_pass http://127.0.0.1:8010;
+    }
+
+    location /dependency_graph {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/dependency_graph(.*)$ /dependency_graph$1 break;
+        proxy_pass http://127.0.0.1:8010;
+    }
+
+    # deepsearch-api's own root-level routes — explicit now that `location /`
+    # below serves the Explorer SPA instead of proxying everything
+    # unmatched. /docs and /redoc are prefix matches, not exact: Swagger
+    # UI/ReDoc can request sub-resources under their own path.
+    location = /health { proxy_pass http://127.0.0.1:8000; }
+    location = /openapi.json { proxy_pass http://127.0.0.1:8000; }
+    # Prometheus /metrics stays private to the container (127.0.0.1:8000
+    # directly): an explicit JSON 404 rather than no location, which would
+    # fall through to the SPA's index.html with a 200.
+    location = /metrics {
+        default_type application/json;
+        return 404 '{"detail":"Not Found"}';
+    }
+    location /docs { proxy_pass http://127.0.0.1:8000; }
+    location /redoc { proxy_pass http://127.0.0.1:8000; }
+
+    # The Explorer SPA (see header comment) at root: try_files serves any of
+    # its own literal files (index.html, ds.png, favicon.ico, manifest.json,
+    # ...) directly, and falls back to index.html for anything else
+    # (client-side routing) — anything actually meant for the API above was
+    # already matched by a more specific location before nginx gets here.
+    # >>> simready-central slim explorer >>>
+    # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+    # SPDX-License-Identifier: Apache-2.0
+    # services/explorer/dist is SimReady Central's search-only Explorer (repo simready-central,
+    # branch slim, slim/devspace/). The locations here are additive — exact matches, longer
+    # prefixes or a regex — and none of his locations is redefined. This block carries: /config.js,
+    # a no-cache /index.html, a 10-min
+    # proxy cache on /search/stats/usd_properties, a shared proxy cache on /images,
+    # /wikidata_hierarchy.json, /library_media/ and JSON 404s for the routes this build does not have. What DOES
+    # reach beyond it: client_max_body_size 32m is server-wide (it applies to ALL his locations
+    # too); `= /images` takes the requests his `/images` prefix served before (same rewrite +
+    # proxy_pass, plus the cache); and an
+    # add_header inside one of our locations replaces his server-level headers for THOSE responses
+    # — /images and the stats cache re-declare his three CORS lines, /config.js and /index.html
+    # (same-origin UI files) do not. Applied by slim/devspace/deploy.sh.
+    client_max_body_size 32m;                         # query-image searches POST a base64 JPEG (nginx default 1 MB)
+    gzip_types text/css application/javascript application/json image/svg+xml;   # stock gzip covers text/html only
+
+    # Runtime index registry (blocking <script src="/config.js">). The CORPUS_NAME marker is
+    # rendered by the same sed that renders the PORT marker (supervisord.conf).
+    # __DOWNLOAD_ENABLED__ is rendered the same way, from $DOWNLOAD_ENABLED
+    # (baked by docker/Dockerfile.hf-space, set true only for a
+    # storage_api-backend corpus — pipeline/bake.py's hf_space_build_args()
+    # — since that's the only backend this image runs a live hf-storage-api
+    # gRPC server for; GET /v3/download/asset works today for neither
+    # backend without it running, and this repo hasn't verified an s3-backend
+    # download path independently, so s3 corpora keep today's false).
+    # seedDefaultScope:false — boot browses the corpus. No defaultFilters (owner, 2026-10-07): the boot browse
+    # shows every license; License stays one click away in the rail.
+    # railFilters + railDefaults ["profiles","simready_metadata_asset_license","category"]: rail = Profiles + License +
+    # the Category tree, all on (owner, 2026-09-30). The rail matches a facet by its parser-catalog field NAME:
+    # search_fields.yaml names it simready_metadata_asset_license since 2026-09-23 ("license" matched nothing and
+    # hid the facet); the parser catalog
+    # docker/hf-space/search_fields.yaml stays curated to profile + license. propertyAliases: this API stores the
+    # Wikidata code as semantic:wikidata_qcode:params:semanticData (wikidata_qcode= matches nothing here), so the
+    # Explorer translates its canonical name at the wire and renames the stats key back on arrival.
+    # propertyFilterCombine "and": the API ORs every filter_by_properties_include_any token globally, so with License
+    # checked a Category pick would change nothing — a property with ONE checked value rides filter_by_properties
+    # (AND) instead; a multi-valued one (the tree's qcodes) stays the OR bucket. Measured: license 1488, one qcode 124,
+    # both in include_any 1488, license AND qcode 124.
+    location = /config.js {
+        default_type application/javascript;
+        add_header Cache-Control "no-cache, must-revalidate" always;
+        return 200 '(function(){var c="__CORPUS_NAME__";if(!c||c.indexOf("__")===0){c="usdsearch-dev";}var e={"field_name":"siglip2-embedding.embedding","dimension":1536};var f={"download":__DOWNLOAD_ENABLED__,"s3UrlRemap":false,"seedDefaultScope":false,"railFilters":["profiles","simready_metadata_asset_license","category"],"railDefaults":["profiles","simready_metadata_asset_license","category"],"propertyAliases":{"wikidata_qcode":"simready_metadata_qcode"},"propertyFilterCombine":"and","submitContentUrl":"__SUBMIT_CONTENT_URL__"};window.__SERVER_MAPPING__={"usdsearch-dev":{"name":c+" (Hugging Face)","apiUrl":"","embedding_config":e,"features":f},"hf-robotiq":{"name":"Robotiq","apiUrl":"","search_path":"/Robotiq-Official/simready-assets/","embedding_config":e,"features":Object.assign({},f,{"libraryPosters":"stills"}),"origin":{"kind":"hf","label":"Robotiq-Official/simready-assets"}},"hf-standardbots":{"name":"Standard Bots","apiUrl":"","search_path":"/standardbots/","embedding_config":e,"features":Object.assign({},f,{"libraryPosters":"stills"}),"origin":{"kind":"hf","label":"standardbots"}}};window.__DEFAULT_SERVER__="usdsearch-dev";})();';
+    }
+    # index.html must always revalidate (covers the try_files fallback too): a swap or rollback
+    # must not leave a browser holding an index.html that names deleted chunks.
+    location = /index.html {
+        root /usr/share/nginx/explorer;
+        add_header Cache-Control "no-cache" always;
+    }
+
+    # Property inventory (rail facets + parser grounding): multi-MB aggregation — cached 10 min.
+    location = /search/stats/usd_properties {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/search(.*)$ /v2/deepsearch/search$1 break;
+        proxy_pass http://127.0.0.1:8000;
+        proxy_ignore_headers Cache-Control Expires;
+        proxy_cache slim_stats_cache;
+        proxy_cache_key "$request_uri";
+        proxy_cache_valid 200 10m;
+        proxy_cache_lock on;
+        proxy_cache_use_stale error timeout http_500 http_502 http_503 http_504;
+        proxy_read_timeout 120s;
+        add_header X-Cache-Status $upstream_cache_status always;
+        # add_header above drops his server-level headers — re-declared as in his template
+        add_header Access-Control-Allow-Origin "*" always;
+        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
+        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
+    }
+    # Thumbnails: his `location /images` rewrite + proxy_pass (this exact match wins over his prefix)
+    # plus a SHARED cache — every cold /images costs the API ~150 CPU-ms on its one event loop.
+    # Keyed by the full URI (image_key, or asset_url + img_offset); the API's `Cache-Control: private`
+    # is ignored on purpose. Valid ONLY while the image runs with STORAGE_REQUIRE_AUTH=False (deploy.sh
+    # refuses a hub Dockerfile without it): with per-user storage auth, add
+    # `proxy_no_cache $arg_asset_url; proxy_cache_bypass $arg_asset_url;` so the access-checked
+    # asset_url path is never shared (image_key is content-addressed and unchecked). add_header here
+    # drops his server-level headers, so his three CORS lines are re-declared; proxy_hide_header
+    # keeps a chained nginx (check.sh --replica) to its own X-Cache-Status.
+    location = /images {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^/images(.*)$ /v3/images$1 break;
+        proxy_pass http://127.0.0.1:8000;
+        proxy_cache slim_images_cache;
+        proxy_cache_key "$request_uri";
+        proxy_ignore_headers Cache-Control Expires;
+        proxy_hide_header X-Cache-Status;
+        proxy_cache_valid 200 7d;
+        proxy_cache_lock on;
+        proxy_cache_lock_timeout 15s;
+        proxy_cache_use_stale error timeout updating;
+        add_header X-Cache-Status $upstream_cache_status always;
+        add_header Access-Control-Allow-Origin "*" always;
+        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
+        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
+    }
+    # Our 404s are JSON like the API's own (a bare `return 404;` would be nginx's text/html error
+    # page): reachable only from the locations below, so nothing of his changes.
+    location @slim_not_found {
+        default_type application/json;
+        return 404 '{"detail":"Not Found"}';
+    }
+    # The Category tree: the `hierarchy` stage's output, restored with the index run (pipeline/hierarchy/store.py);
+    # absent → a real 404 and the Explorer falls back to its __full_path tree.
+    location = /wikidata_hierarchy.json {
+        root /app/hf-space-pipeline/.build/restore/hierarchy;
+        try_files /category_hierarchy.json @slim_not_found;
+    }
+    # One request per result page (QA 6881558: Hugging Face limits each user to ~2,000 requests a minute,
+    # and a page of per-image checks took 50): deepsearch-api's /vlm_validate/search_result_batch streams one
+    # NDJSON verdict per hit. The Explorer calls this path; the request and the lines are the same.
+    # Unbuffered so verdicts land as they come; heartbeats keep the stream open.
+    location = /vlm_validate/batch_stream {
+        if ($request_method = OPTIONS) { add_header Content-Length 0 always; add_header Content-Type "text/plain" always; return 204; }
+        rewrite ^ /v3/deepsearch/vlm_validate/search_result_batch break;
+        proxy_pass http://127.0.0.1:8000;
+        proxy_buffering off;
+        proxy_read_timeout 120s;
+        gzip off;
+        add_header X-Accel-Buffering no always;
+        add_header Access-Control-Allow-Origin "*" always;
+        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
+        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
+    }
+    # Any other /vlm_validate/ path: a JSON 404, never the SPA's index.html.
+    location /vlm_validate/ {
+        default_type application/json;
+        return 404 '{"detail":"Not Found"}';
+    }
+    # Six qualified partner robots are installed from one SHA-pinned S3 ZIP by
+    # pipeline/partner_viewer.py. Its own viewer uses these root-relative paths;
+    # the USD path is narrower than the native-USD release service's route.
+    location = /trial { absolute_redirect off; return 308 /trial/; }
+    location = /trial/ {
+        root /app/hf-space-pipeline/.build/partner_viewer;
+        try_files /trial/index.html @slim_not_found;
+    }
+    location ^~ /trial/ { root /app/hf-space-pipeline/.build/partner_viewer; index index.html; try_files $uri @slim_not_found; }
+    location ^~ /media/ { root /app/hf-space-pipeline/.build/partner_viewer; try_files $uri @slim_not_found; }
+    location ^~ /rust/ { root /app/hf-space-pipeline/.build/partner_viewer; try_files $uri @slim_not_found; }
+    location ^~ /three/ { root /app/hf-space-pipeline/.build/partner_viewer; try_files $uri @slim_not_found; }
+    location ^~ /usd-round2/ { root /app/hf-space-pipeline/.build/partner_viewer; try_files $uri @slim_not_found; }
+    location ^~ /usd/usd-central/rust-assets/hf- {
+        root /app/hf-space-pipeline/.build/partner_viewer;
+        try_files $uri @slim_not_found;
+    }
+    # Library media — the Explorer's joints viewer (model.glb + articulation.json), moving-parts and drop-test
+    # clips, per asset of this corpus: static files pipeline/library_media.py fetches at container start from
+    # the artifact bucket (supervisord program library-media). Not there (not fetched yet, or none for
+    # this corpus) → a JSON 404 and the Explorer shows no media; never the SPA's index.html. Range requests
+    # (Safari's <video>) are nginx's own. add_header drops his server-level headers: his CORS lines re-declared.
+    # Native USD is a separately pinned release. Its verified 2 GiB cache keeps
+    # the full catalog out of the Space's boot-time restore and disk budget.
+    # User-requested production rollback: every interactive asset uses GLB.
+    location = /library_media/usdsearch-dev/usd-catalog.json {
+        alias /app/hf-space-pipeline/pipeline/native_usd_releases/production-glb-catalog.json;
+        default_type application/json;
+        add_header Cache-Control "no-store";
+        gzip_types application/json;
+    }
+    location /usd/usd-central/ {
+        default_type application/json;
+        add_header Cache-Control "no-store";
+        return 404 '{"detail":"Native USD experiment is paused; use GLB"}';
+    }
+    location /usd-rust/ {
+        root /usr/share/nginx/explorer;
+        try_files $uri =404;
+        gzip_static on;
+        add_header X-Content-Type-Options nosniff;
+    }
+    # The three picker entries share one physical corpus and one media archive.
+    # Keep partner URLs on the same files so a scoped picker can load their RTX
+    # media and native USD catalog without duplicating the archive on disk.
+    location = /library_media/hf-robotiq/usd-catalog.json {
+        root /app/hf-space-pipeline/.build;
+        default_type application/json;
+        add_header Cache-Control "no-cache" always;
+    }
+    location = /library_media/hf-standardbots/usd-catalog.json {
+        root /app/hf-space-pipeline/.build;
+        default_type application/json;
+        add_header Cache-Control "no-cache" always;
+    }
+    location ^~ /library_media/hf-robotiq/ {
+        rewrite ^/library_media/hf-robotiq/(.*)$ /library_media/usdsearch-dev/$1 last;
+    }
+    location ^~ /library_media/hf-standardbots/ {
+        rewrite ^/library_media/hf-standardbots/(.*)$ /library_media/usdsearch-dev/$1 last;
+    }
+    location /library_media/ {
+        root /app/hf-space-pipeline/.build;   # .build/library_media/: outside .build/restore/, which the index restore empties
+        try_files $uri @slim_not_found;
+        types { application/json json; model/gltf-binary glb; video/mp4 mp4; image/jpeg jpg; image/webp webp; }
+        default_type application/octet-stream;
+        gzip_types application/json model/gltf-binary;   # meshopt GLBs still shrink under gzip
+        add_header Cache-Control $slim_library_cache always;
+        add_header X-Content-Type-Options nosniff always;
+        add_header Access-Control-Allow-Origin "*" always;
+        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
+        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
+    }
+    # Central's per-user surface is absent in this build: hard 404s, never the SPA's index.html.
+    location ~ ^/(auth|packs|prefs|chats|created_assets|concept_images|meshy_quota|info|process|folder_hierarchy\.json|category_hierarchy\.json|api/create-chat|api/cad2simready)(/|$) {
+        default_type application/json;
+        return 404 '{"detail":"Not Found"}';
+    }
+    # <<< simready-central slim explorer <<<
+    location / {
+        root /usr/share/nginx/explorer;
+        try_files $uri $uri/ /index.html;
+    }
+}

docker/hf-space/supervisord-gpu.conf

@@ -136,6 +136,8 @@ stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
 
 [program:native-usd]
+; User stopped the production USD experiment. Preserve artifacts for later.
+autostart=false
 command=/usr/bin/env -u PYTHONPATH /bin/sh -c "cd /app/hf-space-pipeline && exec /app/.venv/bin/python -m pipeline.native_usd"
 directory=/app/hf-space-pipeline
 user=1000