From 0bd6dde9064d60c7821c36f52dd4bc690ccbbb42 Mon Sep 17 00:00:00 2001 From: Waleed Latif Date: Mon, 9 Nov 2026 22:24:24 -0800 Subject: [PATCH] fix(docker): keep ISR and suffix-list caches writable on a read-only root --- docker/app.Dockerfile | 8 +++++--- docker/pii.Dockerfile | 6 +++++- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/docker/app.Dockerfile b/docker/app.Dockerfile index 1c280ef9161..2683226ba4d 100644 --- a/docker/app.Dockerfile +++ b/docker/app.Dockerfile @@ -252,12 +252,14 @@ COPY --from=builder --chown=nextjs:nodejs /app/apps/sim/lib/execution/sandbox/bu # - apps/sim/.next/cache: the Next image optimizer's disk cache # (.next/cache/images) and the data cache for `fetch` calls with # `next.revalidate`. +# - apps/sim/.next/server/route-cache: where Next writes every revalidated +# (ISR) page and route handler response. # Keep the VOLUME line after every step that writes to these paths: the # classic builder discards later build-time changes to a declared volume. -RUN mkdir -p apps/sim/.next/cache && \ - chown -R nextjs:nodejs apps/sim/.next/cache && \ +RUN mkdir -p apps/sim/.next/cache apps/sim/.next/server/route-cache && \ + chown -R nextjs:nodejs apps/sim/.next/cache apps/sim/.next/server/route-cache && \ chmod 1777 /tmp -VOLUME ["/tmp", "/app/apps/sim/.next/cache"] +VOLUME ["/tmp", "/app/apps/sim/.next/cache", "/app/apps/sim/.next/server/route-cache"] # Switch to non-root user USER nextjs diff --git a/docker/pii.Dockerfile b/docker/pii.Dockerfile index 799c1115c6c..2c77551919b 100644 --- a/docker/pii.Dockerfile +++ b/docker/pii.Dockerfile @@ -46,7 +46,11 @@ COPY --chown=pii:pii --chmod=755 docker/pii-entrypoint.sh ./ # and /tmp (mode 1777), Python's tempfile scratch, stays writable because ECS # copies the image's /tmp into a bind volume mounted at a VOLUME path. The # VOLUME line stays below the model download, which stages wheels in /tmp. -ENV PYTHONDONTWRITEBYTECODE=1 +# tldextract (pulled in by Presidio) caches the Public Suffix List under +# $HOME/.cache by default; point it at /tmp so it caches instead of +# refetching the list on every start. +ENV PYTHONDONTWRITEBYTECODE=1 \ + TLDEXTRACT_CACHE=/tmp/tldextract RUN chmod 1777 /tmp VOLUME ["/tmp"]