Dockerfile

# flashbulb -- CPU image, works on x86-64 and arm64.
#
# The systemd + venv path in deploy/setup.sh is the supported deployment (D-022); this
# image exists for local container runs and for any host that wants a container instead.
#
#   docker build -t flashbulb .
#   docker run --rm -p 8000:8000 --env-file .env --memory=3g flashbulb
#
# --memory=3g is deliberate: this app leaks ~300 MB/day (D-021), so give it a hard
# ceiling and let the runtime restart it rather than letting it exhaust the host.
FROM python:3.12-slim

WORKDIR /app

RUN apt-get update \
 && apt-get install -y --no-install-recommends build-essential \
 && rm -rf /var/lib/apt/lists/*

# torch first, separately, so the CPU build is chosen deliberately.
# ARCH MATTERS: the download.pytorch.org/whl/cpu index serves x86-64 only and 404s on
# aarch64, where the default PyPI wheel is already CPU-only.
ARG TARGETARCH
RUN if [ "$TARGETARCH" = "arm64" ]; then \
        pip install --no-cache-dir torch ; \
    else \
        pip install --no-cache-dir torch --index-url https://download.pytorch.org/whl/cpu ; \
    fi

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Bake the embedder and NLI weights into the image so a cold container serves its first
# request immediately instead of downloading ~400 MB on the visitor's request.
RUN python -c "\
from sentence_transformers import SentenceTransformer, CrossEncoder; \
SentenceTransformer('BAAI/bge-small-en-v1.5', device='cpu'); \
CrossEncoder('cross-encoder/nli-deberta-v3-xsmall', device='cpu')"

COPY . .

EXPOSE 8000
CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "8000"]