Dockerfile

FROM python:3.11-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PYTHONPATH=/app \
    HF_HOME=/app/.cache/huggingface \
    HF_HUB_DISABLE_TELEMETRY=1 \
    ANONYMIZED_TELEMETRY=False

# Hugging Face Spaces run containers as uid 1000 — don't run as root
RUN useradd -m -u 1000 user
WORKDIR /app

COPY requirements.txt .
RUN pip install --no-cache-dir --upgrade pip "setuptools>=83" \
 && pip install --no-cache-dir -r requirements.txt

# Download the embedding model (ONNX export + tokenizer) at build time, pinned to
# the same commit as back_end/config.py, so startup is fast and nothing is
# fetched at runtime. Must match EMBEDDING_ONNX_FILE (default onnx/model.onnx).
RUN python -c "from huggingface_hub import hf_hub_download as d; \
[d('Salesforce/SFR-Embedding-Code-400M_R', f, revision='cb950dc80d677c6fdc00f56c8ddd20ca2642c59e') \
 for f in ('tokenizer.json', 'onnx/model.onnx')]"

COPY . .
RUN mkdir -p /app/temp_git_repo_storage && chown -R user:user /app
USER user

# No Hub access at runtime: only the pinned files above can ever be loaded
ENV HF_HUB_OFFLINE=1

EXPOSE 7860

# The client IP is derived from X-Forwarded-For in back_end/security.py (uvicorn's
# --forwarded-allow-ips "*" would trust the spoofable left-most entry).
CMD ["uvicorn", "back_end.main:app", "--host", "0.0.0.0", "--port", "7860", \
     "--no-server-header", "--log-level", "info"]