Dockerfile

FROM python:3.11-slim as builder

# Install build dependencies
RUN apt-get update && apt-get install -y \
    build-essential \
    && rm -rf /var/lib/apt/lists/*

# Create and activate virtual environment
RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"

WORKDIR /app

# Copy and install requirements
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Final stage
FROM python:3.11-slim

# Install runtime dependencies and security updates
RUN apt-get update && apt-get upgrade -y && \
    apt-get install -y \
    curl \
    tini \
    && rm -rf /var/lib/apt/lists/*

# Copy virtual environment from builder
COPY --from=builder /opt/venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"

WORKDIR /app

# Copy model files first to leverage Docker cache
COPY m2v_model ./m2v_model

# Copy application code
COPY app.py .
COPY requirements.txt .

# Verify model files exist
RUN python -c "import os; assert os.path.exists('m2v_model'), 'Model directory not found'; \
    assert len(os.listdir('m2v_model')) > 0, 'Model directory is empty'; \
    print('Model files verified successfully')"

# Runtime configuration for Cloud Run
ENV PORT=8080
ENV WORKERS=1
ENV WORKER_TIMEOUT=300
ENV PYTHONUNBUFFERED=1
ENV PYTORCH_NUM_THREADS=4
ENV GUNICORN_CMD_ARGS="--worker-tmp-dir /dev/shm"

# Set Python environment
ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONPATH=/app
ENV FLASK_APP=app.py
ENV FLASK_ENV=production

# Non-root user for security
RUN useradd -r -u 1000 appuser && \
    chown -R appuser:appuser /app
USER appuser

# Health check
HEALTHCHECK --interval=30s --timeout=30s --start-period=5s --retries=3 \
    CMD curl -f http://localhost:${PORT}/health || exit 1

# Expose the port
EXPOSE ${PORT}

# Use tini as init system
ENTRYPOINT ["/usr/bin/tini", "--"]

# Use gunicorn for production
CMD exec gunicorn \
    --bind 0.0.0.0:${PORT} \
    --workers $WORKERS \
    --timeout $WORKER_TIMEOUT \
    --worker-class=sync \
    --threads=1 \
    --access-logfile - \
    --error-logfile - \
    --log-level=info \
    --capture-output \
    --enable-stdio-inheritance \
    --worker-tmp-dir /dev/shm \
    --graceful-timeout=30 \
    --keep-alive=65 \
    --max-requests=1000 \
    --max-requests-jitter=50 \
    app:app