Dockerfile

FROM python:3.11-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    TF_CPP_MIN_LOG_LEVEL=2

# System deps for scientific Python (build + fonts for matplotlib)
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    git \
    curl \
    ca-certificates \
    fonts-dejavu-core \
 && rm -rf /var/lib/apt/lists/*

WORKDIR /app
COPY requirements.txt /app/
RUN python -m pip install --upgrade pip && pip install -r requirements.txt

# Copy app source last for better caching
COPY . /app

# Security: run as non-root
RUN useradd -m appuser && chown -R appuser /app
USER appuser

# Cloud Run listens on $PORT
EXPOSE 8080
CMD ["/bin/sh", "-c", "streamlit run app.py --server.port=${PORT:-8080} --server.address=0.0.0.0"]