From c0d57493bbd3e1d173ddcc92f0c65fc02b29a0c3 Mon Sep 17 00:00:00 2001
From: Luis Cosio <luisalfonsocosioizcapa@gmail.com>
Date: Sun, 19 Jul 2026 19:16:24 -0700
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20fix:=20add=20.dockerignore=20to?=
 =?UTF-8?q?=20keep=20.env=20and=20.venv=20out=20of=20image=20layers?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both Dockerfiles COPY . . and Docker does not read .gitignore, so a
developer building with a real .env present would bake
HUGGINGFACE_HUB_TOKEN and API_KEY into an image layer permanently
(a later rm does not remove layer contents). docker-compose.yml already
bind-mounts ./.env:/app/.env:ro at runtime, so the build never needs it.
Also excludes .venv (~1 GB locally) and generated transcript artifacts;
build context drops from ~1 GB to ~41 kB.

*.txt is excluded with a !requirements.txt negation because both
Dockerfiles COPY requirements.txt before the main COPY.

Also: pin Python 3.13 via .python-version, update README prerequisites,
and document in the CUDA Dockerfile why the ubuntu22.04 base is correct
(Python 3.13 already comes from deadsnakes, not the system 3.10).

Verified with a dummy .env and a populated 981 MB .venv in the context:
probe image with the same COPY directives shows .env and .venv absent,
requirements.txt and all app files present.
---
 .dockerignore   | 42 ++++++++++++++++++++++++++++++++++++++++++
 .python-version |  1 +
 Dockerfile      |  8 ++++++++
 README.md       |  2 +-
 4 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100644 .dockerignore
 create mode 100644 .python-version

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..a03b5cb
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,42 @@
+# Docker does not read .gitignore, so this file has to repeat it.
+# Both Dockerfiles do `COPY . .`, so anything not excluded here is baked
+# into an image layer permanently -- a later `rm` does NOT remove it.
+
+# Secrets. docker-compose.yml bind-mounts ./.env:/app/.env:ro at runtime,
+# so the build never needs it. .env.example is kept (pattern is exact).
+.env
+
+# Local virtualenv. ~1 GB once torch/whisperx are installed, and it would
+# shadow the container's own site-packages.
+.venv
+
+# VCS
+.git
+.gitignore
+.dockerignore
+
+# Python build artifacts
+__pycache__/
+*.py[cod]
+
+# Input/output working dirs. Both Dockerfiles `RUN mkdir -p input output`,
+# so excluding the contents here is safe.
+input/*
+output/*
+
+# Generated transcript/summary artifacts (mirrors .gitignore)
+*.json
+*.tsv
+*.vtt
+*.srt
+*.pdf
+*.zip
+*.wav
+*.m4a
+recording.txt
+executive_summary.md
+
+# *.txt is excluded for transcripts, but requirements.txt must stay copyable:
+# both Dockerfiles do `COPY requirements.txt .` before the main COPY.
+*.txt
+!requirements.txt
diff --git a/.python-version b/.python-version
new file mode 100644
index 0000000..24ee5b1
--- /dev/null
+++ b/.python-version
@@ -0,0 +1 @@
+3.13
diff --git a/Dockerfile b/Dockerfile
index 9cce036..ca90ea5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,12 @@
 # Secure Speech-to-Text - GPU Dockerfile (CUDA 12.8 + cuDNN)
+#
+# Python target: 3.13 (matches .python-version and Dockerfile.cpu).
+#
+# This base is ubuntu22.04, whose *system* Python is 3.10. We do not use it --
+# 3.13 comes from the deadsnakes PPA below and is made the default via
+# update-alternatives. Don't "simplify" this by switching to the ubuntu24.04
+# base: it ships Python 3.12, which is further from the 3.13 standard, not
+# closer. WhisperX requires >=3.10,<3.14, so 3.13 is the newest usable minor.
 FROM nvidia/cuda:12.8.0-cudnn-runtime-ubuntu22.04
 
 # Prevent interactive prompts during package installation
diff --git a/README.md b/README.md
index 1aa2e7e..b615b44 100644
--- a/README.md
+++ b/README.md
@@ -112,7 +112,7 @@ python secure_speech_to_text.py meeting.m4a --output-dir ./my-transcripts
 
 ### Prerequisites
 
-- **Python 3.9 to 3.13** (3.14+ not supported by WhisperX)
+- **Python 3.13** (see `.python-version`). WhisperX requires `>=3.10,<3.14`, so 3.13 is the newest usable minor.
 - FFmpeg installed and on PATH
 - A local LLM server for executive summaries (optional)