Dockerfile.frontend

# DocuBot frontend image (D-20).
#
# Streamlit and requests, nothing else. This image must never import the embedding
# stack: it talks to the API over HTTP and has no reason to hold ~900 MB of torch it
# would never call. That separation is also the honest answer to "why two services" --
# the UI pulls and cold-starts fast, and deploys independently of the API.
#
# There is no ingest step and no eval gate here, because there is no index. Everything
# expensive lives in the other image.

FROM python:3.12-slim

ENV PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

# Dependencies before source, so editing the UI does not reinstall Streamlit.
#
# This file lives in frontend/ rather than at the repo root, and the location is load
# bearing (D-35). Streamlit Community Cloud resolves dependencies by searching the
# entrypoint's directory first and the repo root second, and it has no setting to name a
# file. With no frontend/requirements.txt it would fall through to the root
# requirements.txt -- which pins torch from the CPU index, so the UI deploy would try to
# install ~725 MB of PyTorch it never imports, on a 1 GB container. Keeping the single
# copy next to app.py serves both this image and Community Cloud, so the two can never
# drift apart.
COPY frontend/requirements.txt ./
RUN pip install -r requirements.txt

RUN useradd --create-home --uid 1000 docubot

WORKDIR /app
COPY --chown=docubot:docubot frontend/ ./frontend/
# Committed theme config, so the deployed UI matches the README screenshots exactly
# (D-27). Without it Streamlit would follow the viewer's system theme and the shots
# would stop being reproducible.
COPY --chown=docubot:docubot .streamlit/ ./.streamlit/

USER docubot

EXPOSE 8501

# Overridden by docker-compose (http://api:8000) and by the Cloud Run deploy, which
# passes the API service URL (D-23). The default only serves a bare `docker run`.
ENV API_URL=http://localhost:8000 \
    PORT=8501

# Streamlit's own readiness endpoint, not the page itself: /_stcore/health answers as
# soon as the server can serve, without rendering the app.
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
    CMD python -c "import os,sys,urllib.request; u='http://127.0.0.1:'+os.environ.get('PORT','8501')+'/_stcore/health'; sys.exit(0 if urllib.request.urlopen(u, timeout=4).status == 200 else 1)"

# Shell form so $PORT expands at container start (Cloud Run assigns it).
# --server.address 0.0.0.0 is required: Streamlit binds localhost by default, which
# inside a container means unreachable from outside it.
CMD streamlit run frontend/app.py \
    --server.port ${PORT} \
    --server.address 0.0.0.0 \
    --server.headless true