🔒 fix: add .dockerignore to keep .env and .venv out of image layers

Both Dockerfiles COPY . . and Docker does not read .gitignore, so a
developer building with a real .env present would bake
HUGGINGFACE_HUB_TOKEN and API_KEY into an image layer permanently
(a later rm does not remove layer contents). docker-compose.yml already
bind-mounts ./.env:/app/.env:ro at runtime, so the build never needs it.
Also excludes .venv (~1 GB locally) and generated transcript artifacts;
build context drops from ~1 GB to ~41 kB.

*.txt is excluded with a !requirements.txt negation because both
Dockerfiles COPY requirements.txt before the main COPY.

Also: pin Python 3.13 via .python-version, update README prerequisites,
and document in the CUDA Dockerfile why the ubuntu22.04 base is correct
(Python 3.13 already comes from deadsnakes, not the system 3.10).

Verified with a dummy .env and a populated 981 MB .venv in the context:
probe image with the same COPY directives shows .env and .venv absent,
requirements.txt and all app files present.

Author: luiscosio

.dockerignore

@@ -0,0 +1,42 @@
+# Docker does not read .gitignore, so this file has to repeat it.
+# Both Dockerfiles do `COPY . .`, so anything not excluded here is baked
+# into an image layer permanently -- a later `rm` does NOT remove it.
+
+# Secrets. docker-compose.yml bind-mounts ./.env:/app/.env:ro at runtime,
+# so the build never needs it. .env.example is kept (pattern is exact).
+.env
+
+# Local virtualenv. ~1 GB once torch/whisperx are installed, and it would
+# shadow the container's own site-packages.
+.venv
+
+# VCS
+.git
+.gitignore
+.dockerignore
+
+# Python build artifacts
+__pycache__/
+*.py[cod]
+
+# Input/output working dirs. Both Dockerfiles `RUN mkdir -p input output`,
+# so excluding the contents here is safe.
+input/*
+output/*
+
+# Generated transcript/summary artifacts (mirrors .gitignore)
+*.json
+*.tsv
+*.vtt
+*.srt
+*.pdf
+*.zip
+*.wav
+*.m4a
+recording.txt
+executive_summary.md
+
+# *.txt is excluded for transcripts, but requirements.txt must stay copyable:
+# both Dockerfiles do `COPY requirements.txt .` before the main COPY.
+*.txt
+!requirements.txt

.python-version

@@ -0,0 +1 @@
+3.13

Dockerfile

@@ -1,4 +1,12 @@
 # Secure Speech-to-Text - GPU Dockerfile (CUDA 12.8 + cuDNN)
+#
+# Python target: 3.13 (matches .python-version and Dockerfile.cpu).
+#
+# This base is ubuntu22.04, whose *system* Python is 3.10. We do not use it --
+# 3.13 comes from the deadsnakes PPA below and is made the default via
+# update-alternatives. Don't "simplify" this by switching to the ubuntu24.04
+# base: it ships Python 3.12, which is further from the 3.13 standard, not
+# closer. WhisperX requires >=3.10,<3.14, so 3.13 is the newest usable minor.
 FROM nvidia/cuda:12.8.0-cudnn-runtime-ubuntu22.04
 
 # Prevent interactive prompts during package installation

README.md

@@ -112,7 +112,7 @@ python secure_speech_to_text.py meeting.m4a --output-dir ./my-transcripts
 
 ### Prerequisites
 
-- **Python 3.9 to 3.13** (3.14+ not supported by WhisperX)
+- **Python 3.13** (see `.python-version`). WhisperX requires `>=3.10,<3.14`, so 3.13 is the newest usable minor.
 - FFmpeg installed and on PATH
 - A local LLM server for executive summaries (optional)