deploy: sync Dockerfile.hf to Dockerfile for Hugging Face

Dockerfile

@@ -1,109 +1,69 @@
 # ─────────────────────────────────────────────────────────────────────────────
-# CustomerCore — Production Dockerfile (Phase 10)
+# CustomerCore — Hugging Face Spaces Dockerfile (Phase 10)
 #
-# WHY MULTI-STAGE BUILD?
-# Multi-stage builds separate the build environment from the runtime environment.
-# Stage 1 (builder): Installs all dependencies including build tools (gcc, etc.)
-# Stage 2 (runtime): Copies only the installed packages, not the build tools.
-# Result: Final image is ~60% smaller, has a smaller attack surface (no gcc in prod).
+# WHY A SEPARATE DOCKERFILE FOR HF SPACES?
+# HF Spaces has specific constraints:
+#   - 2 vCPUs, 16GB RAM on free tier (Zero GPU)
+#   - No JVM/JDK allowed on the smallest tier (PySpark requires 500MB+ JDK)
+#   - Container must listen on port 7860 (HF Spaces requirement)
+#   - No root user (HF runs as user 1000)
+#   - 50GB ephemeral storage (data is lost on restart — use Supabase for persistence)
 #
-# This image is for the full CustomerCore stack including PySpark/JVM.
-# For Hugging Face Spaces deployment (2 vCPU, 16GB RAM), use Dockerfile.hf
-# which strips PySpark to fit within HF's resource limits.
+# This image strips PySpark and uses a lightweight requirements file.
+# The API still works: BM25 retrieval, LLM routing, and LangGraph triage all function
+# without PySpark. The Bronze→Silver data pipeline is not needed for inference.
 #
-# BASE IMAGE CHOICE: python:3.12-slim-bookworm
-# - slim: Minimal Debian Bookworm (no docs, man pages, debug tools)
-# - bookworm: Debian 12 LTS — security patches until 2028
-# - Not alpine: PySpark's JVM has compatibility issues with Alpine's musl libc
+# HF Spaces deployment:
+#   1. Create a new Space at huggingface.co/spaces
+#   2. Select "Docker" as the SDK
+#   3. Add this file as Dockerfile in the repo root
+#   4. Set secrets in Space settings (same values as Doppler)
 # ─────────────────────────────────────────────────────────────────────────────
 
-# ── Stage 1: Builder ─────────────────────────────────────────────────────────
-FROM python:3.12-slim-bookworm AS builder
+FROM python:3.12-slim-bookworm
 
-# Set build environment
-ENV PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1 \
-    PIP_NO_CACHE_DIR=1 \
-    PIP_DISABLE_PIP_VERSION_CHECK=1
-
-WORKDIR /build
-
-# Install build dependencies (only needed at build time, not runtime)
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    gcc \
-    g++ \
-    libffi-dev \
-    libssl-dev \
-    && rm -rf /var/lib/apt/lists/*
-
-# Install Python dependencies into a prefix directory (not system Python)
-# This makes it easy to copy just the packages into the runtime stage
-COPY requirements.txt .
-RUN --mount=type=cache,target=/root/.cache/pip \
-    sed -i '/pywin32/d' requirements.txt && \
-    pip install --prefix=/install --extra-index-url https://download.pytorch.org/whl/cpu -r requirements.txt
-
-
-# ── Stage 2: Runtime ──────────────────────────────────────────────────────────
-FROM python:3.12-slim-bookworm AS runtime
-
-# Labels for Docker Hub / GitHub Container Registry metadata
-LABEL org.opencontainers.image.title="CustomerCore API" \
-      org.opencontainers.image.description="Enterprise B2B AI Customer Support Platform" \
-      org.opencontainers.image.version="1.0.0" \
-      org.opencontainers.image.authors="Saibalaji Namburi" \
-      org.opencontainers.image.source="https://github.com/saibalajinamburi/CustomerCore"
+LABEL org.opencontainers.image.title="CustomerCore API (HF Spaces)" \
+      org.opencontainers.image.description="CustomerCore — Lightweight deployment for Hugging Face Spaces" \
+      org.opencontainers.image.version="1.0.0"
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     PYTHONPATH=/app \
     APP_ENV=production \
-    PORT=8080
+    # HF Spaces requires port 7860
+    PORT=7860
 
-# Runtime system dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     && rm -rf /var/lib/apt/lists/*
 
-# Create non-root user (security best practice)
-# Running as root in a container is a major security risk:
-# if the container is compromised, root in the container = root on the host
-# when using certain Docker configurations.
-RUN groupadd -r customercore && useradd -r -g customercore customercore
+# HF Spaces runs as user 1000 — create matching user
+RUN useradd -m -u 1000 hfuser
 
 WORKDIR /app
 
-# Copy installed packages from builder stage
-COPY --from=builder /install /usr/local
+# Use the slim CI requirements file — already Linux-safe (no pywin32, pyspark, etc.)
+COPY requirements-ci.txt .
+RUN pip install --no-cache-dir \
+    --extra-index-url https://download.pytorch.org/whl/cpu \
+    -r requirements-ci.txt
 
-# Copy application source code
 COPY src/ ./src/
 COPY pyproject.toml .
 
-# Create directories that the app needs at runtime
-RUN mkdir -p logs data/bronze data/silver data/gold \
-    && chown -R customercore:customercore /app
+RUN mkdir -p logs data \
+    && chown -R hfuser:hfuser /app
 
-# Switch to non-root user
-USER customercore
+USER hfuser
 
-# Health check — Docker checks this every 30s to know if the container is healthy
-# If it fails 3 times in a row, Docker marks the container as unhealthy
-HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
-    CMD curl -f http://localhost:${PORT}/api/v1/health || exit 1
+HEALTHCHECK --interval=30s --timeout=10s --start-period=20s --retries=3 \
+    CMD curl -f http://localhost:7860/api/v1/health || exit 1
 
-# Expose the API port
-EXPOSE ${PORT}
+EXPOSE 7860
 
-# Production server command:
-# - uvicorn: ASGI server for FastAPI
-# - workers: Set to CPU count (2 for HF Spaces, 4+ for Kubernetes)
-# - host 0.0.0.0: Listen on all interfaces (required in containers)
-# - log-level warning: Reduce noise (our structlog middleware handles request logging)
-# - no-access-log: Disabled — our middleware logs structured JSON instead
+# Single worker on HF free tier (2 vCPU)
 CMD ["uvicorn", "src.api.main:app", \
      "--host", "0.0.0.0", \
-     "--port", "8080", \
-     "--workers", "2", \
-     "--log-level", "warning", \
-     "--no-access-log"]
+     "--port", "7860", \
+     "--workers", "1", \
+     "--log-level", "warning"]