Dockerfile

# Hugging Face Space (Docker SDK) — public LIVE demo of the UGC pipeline UI.
# The Space repo root holds this Dockerfile + requirements-demo.txt + README.md and
# the app dirs (pipeline/ migrations/ fixtures/).
FROM python:3.11-slim

# ffmpeg drives assembly (smart stitch + concat + loudnorm + captions);
# libgomp1 is the OpenMP runtime CTranslate2 (kb-whisper ASR) needs.
RUN apt-get update && apt-get install -y --no-install-recommends ffmpeg libgomp1 \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app
# CPU-only torch/torchaudio (for the SpeechBrain VoxLingua107 language gate). The CPU wheels
# keep the image far smaller than the default CUDA build; installed first so requirements reuse them.
RUN pip install --no-cache-dir torch torchaudio --index-url https://download.pytorch.org/whl/cpu
COPY requirements-demo.txt .
RUN pip install --no-cache-dir -r requirements-demo.txt

# faster-whisper (kb-whisper ASR for QC) is installed above. The model is deliberately
# NOT baked at build time: loading kb-whisper-large needs ~2 GB RAM and the cpu-basic
# BUILD container OOM-kills it (exit 137). It downloads lazily on the first QC at RUNTIME,
# where cpu-basic has 16 GB. HF_HOME gives that download a known, world-writable cache dir.
ENV HF_HOME=/app/.cache/huggingface
RUN mkdir -p /app/.cache/huggingface && chmod -R 777 /app/.cache

COPY pipeline ./pipeline
COPY migrations ./migrations
COPY fixtures ./fixtures
# MEDIA_DIR = /app/media (config.py); make it world-writable for the Space runtime.
RUN mkdir -p /app/media && chmod -R 777 /app/media

# Public LIVE demo: REAL Veo generation, hard-capped at MAX_GENERATIONS_PER_DAY/day
# (owner's call — open access). Points at the real `ugc` schema. Secrets on the Space:
# DATABASE_URL, ANTHROPIC_API_KEY, GOOGLE_CLOUD_PROJECT, VEO_MODEL_ID, VERTEX_LOCATION,
# GOOGLE_CREDENTIALS_JSON (the ADC json content).
ENV DRY_RUN=false \
    DB_SCHEMA=ugc \
    MAX_GENERATIONS_PER_DAY=400 \
    VEO_RAI_AUTORETRY=true \
    PYTHONUNBUFFERED=1

COPY entrypoint.sh /app/entrypoint.sh
RUN chmod +x /app/entrypoint.sh

EXPOSE 7860
# entrypoint writes the Google ADC json from the secret (if set), migrates, then serves.
CMD ["/app/entrypoint.sh"]