Update DockerFile to Avoid Having a Second Port

Dockerfile

@@ -1,67 +1,44 @@
-FROM python:3.12.11-slim
-
-# Set environment variables for Python
-ENV PYTHONUNBUFFERED=1
-ENV PYTHONDONTWRITEBYTECODE=1
-
-# Create app directory and switch to it
-WORKDIR /app
-
-# Install system dependencies required for your packages
-RUN apt-get update && \
-    apt-get install -y \
-    build-essential \
-    curl \
-    git \
-    libgomp1 \
-    supervisor \
-    && rm -rf /var/lib/apt/lists/*
-
-# Copy requirements first for better Docker layer caching
-COPY requirements.txt .
-
-# Install Python dependencies
-RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir -r requirements.txt
-
-# Copy the entire application
-COPY . .
-
-# Create necessary directories if they don't exist
-RUN mkdir -p /app/data /app/embeddings /app/graph /app/metadata /var/log/supervisor
-
-# Create supervisor configuration
-COPY <<EOF /etc/supervisor/conf.d/supervisord.conf
-[supervisord]
-nodaemon=true
-logfile=/var/log/supervisor/supervisord.log
-pidfile=/var/run/supervisord.pid
-
-[program:realtime_server]
-command=python realtime_server.py --port=7861 --host=0.0.0.0
-directory=/app
-autostart=true
-autorestart=true
-stderr_logfile=/var/log/supervisor/realtime_server.err.log
-stdout_logfile=/var/log/supervisor/realtime_server.out.log
-priority=100
-
-[program:streamlit]
-command=streamlit run app.py --server.port=7860 --server.address=0.0.0.0 --server.enableXsrfProtection=false --server.enableCORS=false
-directory=/app
-autostart=true
-autorestart=true
-stderr_logfile=/var/log/supervisor/streamlit.err.log
-stdout_logfile=/var/log/supervisor/streamlit.out.log
-priority=200
-EOF
-
-# Expose both ports (Streamlit on 7860, Realtime API on 7861)
-EXPOSE 7860 7861
-
-# Health check for both services
-HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
-    CMD curl --fail http://localhost:7860/_stcore/health && curl --fail http://localhost:7861/health || exit 1
-
-# Use supervisor to run both services
-CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]
+FROM python:3.12.11-slim
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PIP_NO_CACHE_DIR=1 \
+    DEBIAN_FRONTEND=noninteractive
+
+WORKDIR /app
+
+# System deps
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      build-essential curl git libgomp1 supervisor nginx \
+    && rm -rf /var/lib/apt/lists/*
+
+# Requirements first (better caching)
+COPY requirements.txt .
+RUN python -m pip install --upgrade pip \
+ && pip install -r requirements.txt
+
+# App source
+COPY . .
+
+# Nginx + Supervisor configs
+COPY nginx.conf /etc/nginx/nginx.conf
+COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf
+
+# Needed dirs
+RUN mkdir -p /app/data /app/embeddings /app/graph /app/metadata \
+             /var/log/supervisor /run
+
+# (Optional) Drop root
+RUN useradd -m -u 1000 appuser \
+ && chown -R appuser:appuser /app /var/log/supervisor /run
+USER appuser
+
+# HF Spaces proxies this port
+EXPOSE 7860
+
+# Healthcheck hits Streamlit through Nginx (public path) and API via path
+HEALTHCHECK --interval=30s --timeout=10s --start-period=90s --retries=3 \
+  CMD curl -fsS http://localhost:7860/_stcore/health >/dev/null \
+   && curl -fsS http://localhost:7860/api/health >/dev/null || exit 1
+
+CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]