fix(docker): keep ISR and suffix-list caches writable on a read-only root

Author: waleedlatif1

docker/app.Dockerfile

@@ -252,12 +252,14 @@ COPY --from=builder --chown=nextjs:nodejs /app/apps/sim/lib/execution/sandbox/bu
 # - apps/sim/.next/cache: the Next image optimizer's disk cache
 #   (.next/cache/images) and the data cache for `fetch` calls with
 #   `next.revalidate`.
+# - apps/sim/.next/server/route-cache: where Next writes every revalidated
+#   (ISR) page and route handler response.
 # Keep the VOLUME line after every step that writes to these paths: the
 # classic builder discards later build-time changes to a declared volume.
-RUN mkdir -p apps/sim/.next/cache && \
-    chown -R nextjs:nodejs apps/sim/.next/cache && \
+RUN mkdir -p apps/sim/.next/cache apps/sim/.next/server/route-cache && \
+    chown -R nextjs:nodejs apps/sim/.next/cache apps/sim/.next/server/route-cache && \
     chmod 1777 /tmp
-VOLUME ["/tmp", "/app/apps/sim/.next/cache"]
+VOLUME ["/tmp", "/app/apps/sim/.next/cache", "/app/apps/sim/.next/server/route-cache"]
 
 # Switch to non-root user
 USER nextjs

docker/pii.Dockerfile

@@ -46,7 +46,11 @@ COPY --chown=pii:pii --chmod=755 docker/pii-entrypoint.sh ./
 # and /tmp (mode 1777), Python's tempfile scratch, stays writable because ECS
 # copies the image's /tmp into a bind volume mounted at a VOLUME path. The
 # VOLUME line stays below the model download, which stages wheels in /tmp.
-ENV PYTHONDONTWRITEBYTECODE=1
+# tldextract (pulled in by Presidio) caches the Public Suffix List under
+# $HOME/.cache by default; point it at /tmp so it caches instead of
+# refetching the list on every start.
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    TLDEXTRACT_CACHE=/tmp/tldextract
 RUN chmod 1777 /tmp
 VOLUME ["/tmp"]