| FROM python:3.11-slim | |
| RUN useradd -m -u 1000 user | |
| WORKDIR /app | |
| COPY requirements.txt . | |
| RUN pip install --no-cache-dir -r requirements.txt | |
| COPY . . | |
| RUN pip install --no-cache-dir --no-deps -e . \ | |
| # repo files can arrive mode 600/700; the runtime user must read assets/tokens/fonts | |
| && chmod -R a+rX /app | |
| USER user | |
| ENV HOME=/home/user \ | |
| HF_HOME=/home/user/.cache/huggingface \ | |
| # The Space IS the hosted demo: judge-only presets, API backends, recorded seeds. | |
| # Space variables (Settings -> Variables) override these at runtime. | |
| SIRIN_UI_HOSTED=1 \ | |
| # Stage-1 verified 2026-09-17 (reasoning off): 3/3 verbatim echo, spans tagged, ~5s, logprobs. | |
| SIRIN_OPENROUTER_MODEL=nex-agi/nex-n2.5-pro:free \ | |
| # Server-side OpenRouter fallbacks (same reasoning-off setting): only routes that still | |
| # tag spans without reasoning belong here — nemotron-super goes all-clear and is excluded. | |
| SIRIN_OPENROUTER_FALLBACK_MODELS=dots-studio/dots-3-note-preview:free,z-ai/glm-5.2:free \ | |
| STREAMLIT_SERVER_MAX_UPLOAD_SIZE=5 | |
| EXPOSE 8501 | |
| ENTRYPOINT ["streamlit", "run", "sirin/ui/streamlit_app.py", \ | |
| "--server.port=8501", "--server.address=0.0.0.0", \ | |
| "--server.headless=true", "--server.enableXsrfProtection=false"] | |