Update Dockerfile

Dockerfile

@@ -1,48 +1,62 @@
 # ─────────────────────────────────────────────────────────
-# SocialCrypt Server — Dockerfile
-# 
-# Build & Run locally:
-#   docker build -t socialcrypt .
-#   docker run -d -p 3000:3000 -v data:/app/data socialcrypt
+# SocialCrypt Server — HuggingFace Spaces Dockerfile
 #
 # Deploy to HuggingFace Spaces:
-#   1. Create a Space → Docker SDK
-#   2. Push this repo (Dockerfile + server.js)
-#   3. Set port to 7860 in Space settings
-#   4. Done!
+#   1. Go to https://huggingface.co/spaces → New Space
+#   2. Choose "Docker" as Space SDK
+#   3. Name your space (e.g., "socialcrypt-server")
+#   4. Push this repo:
+#        git init
+#        git add server_hf.js Dockerfile.hf .dockerignore
+#        git commit -m "SocialCrypt HF deploy"
+#        git remote add space https://huggingface.co/spaces/YOUR_USER/socialcrypt-server
+#        git push space main
+#   5. ✅ Done! (Port 7860 is the default)
 #
-# Deploy to Railway / Fly.io / Render:
-#   Just connect the GitHub repo → auto-detects Dockerfile
+#   Your endpoint:
+#     Read:  https://YOUR_USER-socialcrypt-server.hf.space/blobs.jsonl
+#     Write: https://YOUR_USER-socialcrypt-server.hf.space/submit
+#     Web:   https://YOUR_USER-socialcrypt-server.hf.space/
+#
+# ⚠️ HuggingFace Spaces mounts the /data persistent volume
+#    at RUNTIME, and it comes in owned by root. The entrypoint
+#    script runs as root first, fixes ownership, then drops
+#    privileges to a non-root user for security.
 # ─────────────────────────────────────────────────────────
 
-# ── Stage 1: Base ───────────────────────────────────────
-FROM node:20-alpine AS base
+FROM node:20-alpine
 
-# Add tini for proper signal handling (SIGTERM → graceful shutdown)
-RUN apk add --no-cache tini
+# Install tini + su-exec (drop privileges tool)
+RUN apk add --no-cache tini su-exec
 
 WORKDIR /app
 
-# ── Stage 2: Runtime ────────────────────────────────────
-FROM base AS release
-
-# Copy only the server script (no npm dependencies — it's pure Node.js stdlib!)
-COPY server.js .
-
-# Create the data volume mount point
-RUN mkdir -p /app/data
 
-# Use a non-root user for security
+# Create a non-root user for the app to run as
 RUN addgroup -g 1001 -S appgroup && \
     adduser -S appuser -u 1001 -G appgroup && \
     chown -R appuser:appgroup /app
-USER appuser
-
-# Expose the port (default 3000, override with PORT env var)
-EXPOSE 3000
-
-# Use tini as PID 1 for proper signal handling
-ENTRYPOINT ["/sbin/tini", "--"]
 
-# Run the server
-CMD ["node", "server.js"]
+# Pre-create /data so the volume mount point exists
+RUN mkdir -p /data
+
+# ─── Entrypoint script ──────────────────────────────────
+# This runs as ROOT (no USER directive before ENTRYPOINT).
+# It fixes /data ownership, THEN drops to appuser.
+RUN echo '#!/bin/sh\n\
+set -e\n\
+\n\
+# HuggingFace mounts /data at runtime, owned by root.\n\
+# Fix ownership so the non-root app can write to it.\n\
+chown -R appuser:appgroup /data\n\
+\n\
+# Drop privileges and run the app\n\
+exec su-exec appuser:appgroup node /app/server.js "$@"\n\
+' > /entrypoint.sh && chmod +x /entrypoint.sh
+
+# NO "USER appuser" HERE — the entrypoint runs as root,
+# then drops privileges via su-exec internally.
+
+EXPOSE 7860
+
+ENTRYPOINT ["/sbin/tini", "--", "/entrypoint.sh"]