Dockerfile

# ── Stage 1: builder ────────────────────────────────────────────────────────
FROM python:3.11-slim AS builder

WORKDIR /app

# System deps for sentence-transformers + chromadb
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    git \
    && rm -rf /var/lib/apt/lists/*

COPY requirements.txt .
RUN pip install --upgrade pip && \
    pip install --no-cache-dir --prefix=/install -r requirements.txt

# ── Stage 2: runtime ─────────────────────────────────────────────────────────
FROM python:3.11-slim

WORKDIR /app

# Runtime system deps only
RUN apt-get update && apt-get install -y --no-install-recommends \
    libgomp1 \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Copy installed packages from builder
COPY --from=builder /install /usr/local

# Copy application source
COPY config/ ./config/
COPY src/  ./src/
COPY setup.py pyproject.toml ./

# Create non-root user
RUN addgroup --system cinematch && adduser --system --ingroup cinematch cinematch
RUN mkdir -p /app/data /app/cache /app/logs && \
    chown -R cinematch:cinematch /app

USER cinematch

ENV PYTHONPATH=/app \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    LOG_FORMAT=json \
    API_HOST=0.0.0.0 \
    API_PORT=8000

# API_PORT can be overridden at runtime (e.g. HF Spaces sets API_PORT=7860)
EXPOSE 8000

HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=5 \
  CMD curl -f http://localhost:${PORT:-${API_PORT:-8000}}/api/v1/health/ || exit 1

CMD ["sh", "-c", "python -m uvicorn src.api.main:app --host 0.0.0.0 --port ${PORT:-${API_PORT:-8000}} --workers 1 --log-level info"]