FROM python:3.11-slim

WORKDIR /app

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

ENV PLAYWRIGHT_BROWSERS_PATH=0

RUN playwright install-deps chromium && \
    playwright install chromium

COPY . .

# Hugging Face Spaces' documented convention for custom Docker Spaces: a
# non-root user with a fixed UID
# (https://huggingface.co/docs/hub/spaces-sdks-docker#permissions). Chromium
# is launched with --no-sandbox (see api_lifespan in app.py) since its own
# internal sandbox needs privileges this non-root user doesn't have.
RUN useradd -m -u 1000 user && chown -R user:user /app
USER user

EXPOSE 7860

CMD ["python", "./app.py"]