FROM python:3.12-slim-bookworm
WORKDIR /app
RUN pip install --no-cache-dir fastapi==0.142.2 httpx==0.28.1 uvicorn==0.54.0
COPY control /app/control
ENV PYTHONUNBUFFERED=1
# Dedicated trusted management process: never share this socket with speech/Hermes.
CMD ["python", "-m", "control"]