Dockerfile

FROM python:3.11-slim

# System deps for Playwright + Node.js + git
RUN apt-get update && apt-get install -y \
    wget curl gnupg ca-certificates git \
    libnss3 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 \
    libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 \
    libgbm1 libasound2 libxshmfence1 libx11-xcb1 \
    libxcb-dri3-0 libpango-1.0-0 libcairo2 libfontconfig1 \
    fonts-liberation libappindicator3-1 xdg-utils \
    && rm -rf /var/lib/apt/lists/*

# Install Node.js 20 LTS (needed to run ever-jobs NestJS API)
RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
    && apt-get install -y nodejs \
    && rm -rf /var/lib/apt/lists/*

# Create non-root user (HF Spaces requirement)
RUN useradd -m -u 1000 user
USER user
ENV HOME=/home/user PATH=/home/user/.local/bin:$PATH

WORKDIR /app

# Install Python deps (separate layer — cached unless requirements.txt changes)
COPY --chown=user requirements.txt .
RUN pip install --no-cache-dir --upgrade pip \
 && pip install --no-cache-dir -r requirements.txt

# Install Playwright Chromium browser
RUN playwright install chromium

# Clone ever-jobs and install Node deps (separate layer — cached unless repo changes)
# vendor/ is in .dockerignore so it never comes from the build context
# nest-cli.json forces webpack which isn't installed; ts-node (nest start) is used at runtime instead
RUN git clone https://github.com/ever-jobs/ever-jobs.git vendor/ever-jobs --depth=1 \
    && cd vendor/ever-jobs \
    && npm install --legacy-peer-deps \
    && sed -i 's/"webpack": true/"webpack": false/g' nest-cli.json

# Copy app code (this layer re-runs on every code change, which is expected)
COPY --chown=user . .

# Create required runtime directories
RUN mkdir -p data/resume data/output/resumes data/output/reports \
             data/research_cache data/logs data/output/run_history

# Make startup script executable
RUN chmod +x start.sh

# Expose Streamlit port
EXPOSE 7860

ENV STREAMLIT_SERVER_PORT=7860 \
    STREAMLIT_SERVER_ADDRESS=0.0.0.0 \
    STREAMLIT_SERVER_HEADLESS=true \
    STREAMLIT_BROWSER_GATHER_USAGE_STATS=false

# start.sh boots ever-jobs on port 3001, then launches Streamlit on 7860
CMD ["./start.sh"]