dockerfile

```dockerfile
# Stage 1: Builder
FROM python:3.10-slim AS builder

# Install build dependencies
RUN apt-get update && apt-get install -y \
    build-essential \
    gcc \
    g++ \
    libffi-dev \
    libssl-dev \
    && rm -rf /var/lib/apt/lists/*

# Upgrade pip and install wheel
RUN pip install --upgrade pip setuptools wheel

# Create virtual environment
RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"

# Copy requirements and install dependencies
WORKDIR /build
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Pre-download transformer models
RUN mkdir -p /app/cache && \
    python -c "from transformers import AutoModel, AutoTokenizer; \
               AutoModel.from_pretrained('HooshvareLab/bert-fa-base-uncased', cache_dir='/app/cache'); \
               AutoTokenizer.from_pretrained('HooshvareLab/bert-fa-base-uncased', cache_dir='/app/cache')" || true
RUN python -c "from transformers import TrOCRProcessor, VisionEncoderDecoderModel; \
               TrOCRProcessor.from_pretrained('microsoft/trocr-base-printed', cache_dir='/app/cache'); \
               VisionEncoderDecoderModel.from_pretrained('microsoft/trocr-base-printed', cache_dir='/app/cache')" || true

# Stage 2: Production
FROM python:3.10-slim

# Install runtime dependencies
RUN apt-get update && apt-get install -y \
    sqlite3 \
    && rm -rf /var/lib/apt/lists/* \
    && apt-get clean

# Create non-root user
RUN groupadd -g 1000 appuser && useradd -r -u 1000 -g appuser appuser

# Copy virtual environment from builder
COPY --from=builder /opt/venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"

# Copy cached models
COPY --from=builder /app/cache /app/cache

# Create required directories
RUN mkdir -p /app/data /app/logs /app/uploads && \
    chown -R appuser:appuser /app/data /app/logs /app/uploads /app/cache

# Set working directory
WORKDIR /app

# Copy all files
COPY --chown=appuser:appuser . .

# Environment variables
ENV PYTHONPATH=/app
ENV HF_HOME=/app/cache
ENV LOG_LEVEL=INFO
ENV ENVIRONMENT=production
ENV PYTHONUNBUFFERED=1
ENV API_BASE_URL=http://localhost:8000
ENV APP_MODE=gradio

# Switch to non-root user
USER appuser

# Expose ports for Gradio and FastAPI
EXPOSE 7860
EXPOSE 8000

# Start application via run.py
CMD ["python", "run.py"]
```