Documentation Index
Fetch the complete documentation index at: https://mintlify.com/Jatin-Mehra119/PDF-Insight-Beta/llms.txt
Use this file to discover all available pages before exploring further.
Docker is the primary supported deployment method for PDF Insight Pro. The container is built on python:3.12-slim, runs the FastAPI server via Uvicorn on port 7860 (the Hugging Face Spaces default), and executes as a non-root appuser to minimise the attack surface of the running process.
Prerequisites
- Docker 20.10 or later (BuildKit must be enabled — it is by default in Docker 23+)
- A Groq API key (required)
- A Tavily API key (required at build time by the Dockerfile)
Build and Run
Clone the repository
git clone https://github.com/Jatin-Mehra119/PDF-Insight-Beta.git
cd PDF-Insight-Beta
Write your secrets to files
Docker’s --mount type=secret reads secrets from files on the host. Create
the two required secret files before building:echo -n "your_groq_api_key" > /tmp/GROQ_API_KEY
echo -n "your_tavily_api_key" > /tmp/TAVILY_API_KEY
Build the Docker image
Pass both secrets at build time using --secret. The Dockerfile declares
ARG GROQ_API_KEY and ARG TAVILY_API_KEY and mounts them during the
corresponding RUN layers.DOCKER_BUILDKIT=1 docker build \
--secret id=GROQ_API_KEY,src=/tmp/GROQ_API_KEY \
--secret id=TAVILY_API_KEY,src=/tmp/TAVILY_API_KEY \
-t pdf-insight-pro .
Run the container
Mount the same secrets at runtime so the application process can read them
from /run/secrets/:docker run -p 7860:7860 \
--mount type=secret,id=GROQ_API_KEY,dst=/run/secrets/GROQ_API_KEY \
--mount type=secret,id=TAVILY_API_KEY,dst=/run/secrets/TAVILY_API_KEY \
pdf-insight-pro
Open the application
Navigate to http://localhost:7860 in your browser.
The FastAPI static frontend will load and you can start uploading PDFs
immediately. Dockerfile Highlights
The Dockerfile makes several deliberate decisions worth understanding before
you customise it.
| Decision | Detail |
|---|
| Base image | python:3.12-slim — minimal Debian image with Python 3.12 pre-installed, keeps the final image small |
| System dependencies | gcc and python3-dev are installed (and their apt cache removed) for compiling native extensions required by LangChain |
| Non-root user | appuser is created with useradd -m -s /bin/bash appuser and the container switches to it before the CMD is executed |
| Uploads directory | /app/uploads is created and chowned to appuser before files are copied, ensuring the server can write session data and PDFs |
| Secrets at build time | RUN --mount=type=secret layers read GROQ_API_KEY and TAVILY_API_KEY without ever writing them into a filesystem layer |
| Exposed port | EXPOSE 7860 matches the Hugging Face Spaces Docker SDK default; the Uvicorn CMD binds to 0.0.0.0:7860 |
Full Dockerfile
FROM python:3.12-slim
WORKDIR /app
# Install system dependencies for langchain
RUN apt-get update && apt-get install -y --no-install-recommends \
gcc \
python3-dev \
&& rm -rf /var/lib/apt/lists/*
# Create a non-root user and set up uploads directory
RUN useradd -m -s /bin/bash appuser && \
mkdir -p /app/uploads && \
chown appuser:appuser /app/uploads
# Copy application files and set permissions
COPY . .
RUN chown -R appuser:appuser /app && \
chmod -R u+rwx /app && \
chmod -R u+rwx /usr/local/lib/python3.12 /usr/local/bin
# Install dependencies and verify uvicorn
RUN python -m pip install --no-cache-dir -r requirements.txt && \
python -m pip install --no-cache-dir uvicorn && \
uvicorn --version
# Accept the secret token as a build argument
ARG GROQ_API_KEY
ARG TAVILY_API_KEY
# Docs: https://huggingface.co/docs/hub/en/spaces-sdks-docker#secrets-and-variables-management
# Expose the secret GROQ_API_KEY and OLLAMA_API_TOKEN at build time and set them as environment variables
RUN --mount=type=secret,id=GROQ_API_KEY,mode=0444,required=true \
export GROQ_API_KEY=$(cat /run/secrets/GROQ_API_KEY) && \
echo "GROQ_API_KEY is set."
RUN --mount=type=secret,id=TAVILY_API_KEY,mode=0444,required=true \
export TAVILY_API_KEY=$(cat /run/secrets/TAVILY_API_KEY) && \
echo "TAVILY_API_KEY is set."
# Set environment variables
ENV PYTHONPATH=/app \
PATH=/usr/local/bin:$PATH
# Switch to non-root user
USER appuser
# Expose Streamlit port
EXPOSE 7860
# Run the fastapi server
CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860"]
Never ENV GROQ_API_KEY=... or ARG GROQ_API_KEY=... with a literal value
in your Dockerfile. Environment variables set with ENV and build arguments
set with ARG are baked into the image’s layer history and can be extracted
with docker history. Always supply secrets through --mount type=secret as
shown above.
The /app/uploads directory — where the server stores uploaded PDFs and
serialised session .pkl files — lives inside the container’s ephemeral
filesystem. It is wiped every time the container is removed. If you need
uploads to survive container restarts, mount a host directory or a named
volume:docker run -p 7860:7860 \
--mount type=secret,id=GROQ_API_KEY,dst=/run/secrets/GROQ_API_KEY \
--mount type=secret,id=TAVILY_API_KEY,dst=/run/secrets/TAVILY_API_KEY \
-v $(pwd)/uploads:/app/uploads \
pdf-insight-pro