dockerfile

# Production-optimized Dockerfile for ML Server
FROM python:3.11-slim

# Set production environment
ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    TF_CPP_MIN_LOG_LEVEL=2 \
    CLASS_ORDER=FAKE_REAL \
    PORT=5000 \
    HOST=0.0.0.0 \
    WORKERS=2

# Install production system dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    libopencv-dev \
    python3-opencv \
    libglib2.0-0 \
    libsm6 \
    libxext6 \
    libxrender-dev \
    libgomp1 \
    libgcc-s1 \
    && rm -rf /var/lib/apt/lists/* \
    && apt-get clean

# Create production user
RUN groupadd -r mluser && useradd -r -g mluser -d /app -s /bin/bash mluser

# Set working directory
WORKDIR /app

# Copy requirements first for better caching
COPY --chown=mluser:mluser requirements.txt .

# Install Python dependencies
RUN pip install --no-cache-dir --upgrade pip==23.3.1 && \
    pip install --no-cache-dir -r requirements.txt && \
    pip install --no-cache-dir gunicorn==21.2.0 && \
    find /usr/local -name "*.pyc" -delete && \
    find /usr/local -name "__pycache__" -type d -exec rm -rf {} + || true

# Copy application files
COPY --chown=mluser:mluser ml_server.py .
COPY --chown=mluser:mluser certificate_classifier.h5 .

# Copy class indices if they exist (optional)
COPY --chown=mluser:mluser class_indices.json* ./
COPY --chown=mluser:mluser class_indices.npy* ./

# Create logs directory
RUN mkdir -p /app/logs && chown mluser:mluser /app/logs

# Switch to non-root user
USER mluser

# Expose port
EXPOSE 5000

# Health check with timeout
HEALTHCHECK --interval=30s --timeout=15s --start-period=60s --retries=3 \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:$PORT/health', timeout=10)" || exit 1

# Production startup with gunicorn
CMD ["gunicorn", \
     "--bind", "0.0.0.0:5000", \
     "--workers", "2", \
     "--timeout", "120", \
     "--worker-class", "sync", \
     "--max-requests", "1000", \
     "--max-requests-jitter", "100", \
     "--preload", \
     "--access-logfile", "/app/logs/access.log", \
     "--error-logfile", "/app/logs/error.log", \
     "--log-level", "info", \
     "--capture-output", \
     "ml_server:app"]