Set default runtime model cache path and fix Docker CI compatibility

[Copilot]

This PR addresses follow-up Docker feedback by fixing both runtime cache behavior for embedding models and Docker build compatibility in CI.

• Runtime cache configuration

  • Create /home/embedder/models in the runtime image.
  • Set ownership to the non-root embedder user.
  • Export EMBEDDING_CACHE_DIR=/home/embedder/models as the default runtime cache location.

• Docker CI compatibility update

  • Switch builder image to rust:1.95-slim-trixie.
  • Switch runtime image to debian:trixie-slim.
  • Update runtime OpenSSL package from libssl3 to libssl3t64.

• Why this matters

  • Keeps model/ONNX artifacts in a deterministic writable cache path across restarts.
  • Resolves Docker build failures caused by toolchain/runtime libc compatibility mismatches in CI.

FROM rust:1.95-slim-trixie AS builder
FROM debian:trixie-slim AS runtime

RUN useradd --create-home --uid 10001 embedder
RUN mkdir -p /home/embedder/models && chown embedder:embedder /home/embedder/models
ENV EMBEDDING_CACHE_DIR=/home/embedder/models

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• cdn.pyke.io
  • Triggering command: /home/REDACTED/work/embedding/embedding/target/debug/build/ort-sys-08bd7c6ae3419da0/build-script-main /home/REDACTED/work/embedding/embedding/target/debug/build/ort-sys-08bd7c6ae3419da0/build-script-main /home/REDACTED/work/embedding/embedding/target/debug/build/onig_sys-02731b02c59eeaf9/out/a445302c6d3dcb51-unicode_fold2_key.o /tmp/ccKEy9d8.s as f9/out/a445302c6d3dcb51-sjis_prop.o f9/out/libonig.a f9/out/a445302c6d3dcb51-iso8859_16.o f9/out/a445302c6d3dcb51-euc_tw.o f9/out/a445302c6d3dcb51-euc_kr.o f9/out/a445302c6d3dcb51-big5.o f9/out/a445302c6d3dcb51-gb18030.o f9/out/a445302c6d3dcb51-koi8_r.o f9/out/a445302c6d3dcb51-cp1251.o f9/out/a445302c6d3dcb51-euc_jp_prop.o f9/out/a445302c6d3dcb51-sjis_prop.o f9/out/a445302c6d3dcb51-unicode_unfold_key.o f9/out/a445302c6d3dcb51-unicode_fold1_key.o f9/out/a445302c6d3dcb51-unicode_fold2_key.o f9/out/a445302c6d3dcb51-unicode_fold3_key.o stup/toolchains//home/REDACTED/work/embedding/embedding/target/debug/build/onig_sys-02731b02c59eeaf9/out (dns block)
  • Triggering command: /app/target/release/build/ort-sys-0136a8d5c67f5f15/build-script-main /app/target/release/build/ort-sys-0136a8d5c67f5f15/build-script-main /tmp/ccQlO4wH.s oniguruma/src/iso8859_11.c o 49cf�� 5.0-x86_64-unknooniguruma/src ib/rustlib/x86_6--64 wn-linux-gnu/bin-o 5.0-x86_64-unknocc -incompat dex.crates.io-19-ffunction-sections _fold2_key.o dex.�� 5.0-x86_64-unkno-m64 ib/rustlib/x86_6-I wn-linux-gnu/bin/app/target/release/build/onig_sys-52efc89e3c4b4c90/out 2a81194c9d07bbf6as -incompat dex.crates.io-19-I 6d3dcb51-iso8859/app/target/release/build/onig_sys-52efc89e3c4b4c90/out (dns block)
  • Triggering command: /app/target/release/build/ort-sys-0136a8d5c67f5f15/build-script-main /app/target/release/build/ort-sys-0136a8d5c67f5f15/build-script-main ase/deps/libtrac-W c58b.rlib 6d3dcb51-utf32_l/app/target/release/build/onig_sys-52efc89e3c4b4c90/out wn-l�� wn-linux-gnu/liboniguruma/src wn-linux-gnu/lib--64 49cf8c6b5b557f/u-o wn-linux-gnu/lib/usr/local/rustup/toolchains/1.95.0-x86_64-REDACTED-linux-gnu/bin/rustc -incompat wn-linux-gnu/libonig_sys wn-linux-gnu/lib--edition=2021 wn-l�� wn-linux-gnu/lib--error-format=json c90/out /collect2 ase/build/ring-e/check p/toolchains/1.9--emit=dep-info,metadata,link p/toolchains/1.9-C 6d3dcb51-cp1251.opt-level=3 (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[ArnabChatterjee20k]

@copilot fix this

[Copilot]

@copilot fix this

Fixed in commit 1ee5f4c. I updated the Dockerfile to use trixie-based builder/runtime images and switched runtime OpenSSL package to libssl3t64 to address the Docker CI link failure. No UI changes were made, so there is no UI screenshot.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• cdn.pyke.io
  • Triggering command: /home/REDACTED/work/embedding/embedding/target/debug/build/ort-sys-08bd7c6ae3419da0/build-script-main /home/REDACTED/work/embedding/embedding/target/debug/build/ort-sys-08bd7c6ae3419da0/build-script-main /home/REDACTED/work/embedding/embedding/target/debug/deps/rustcljBwYG/rmeta.o /home/REDACTED/work/embedding/embedding/target/debug/deps/num_derive-4fdd9aedcfcf6/home/REDACTED/work/embedding/embedding/target/debug/deps/libstrsim-ad06d3910bdf6954.rlib 79/build-script-build -Wl,-Bstatic /home/REDACTED/work/embedding/embedding/target/debug/deps/libsyn-494380fb51394f97./home/REDACTED/work/embedding/embedding/target/debug/deps/libsyn-494380fb51394f97.rlib /home/REDACTED/work/embedding/embedding/target/debug/deps/libquote-18ed579c8635b8c/home/REDACTED/work/embedding/embedding/target/debug/deps/libquote-18ed579c8635b8c4.rlib /home/REDACTED/work/embedding/embedding/target/debug/deps/libproc_macro2-2d78e4228/home/REDACTED/work/embedding/embedding/target/debug/deps/libproc_macro2-2d78e42288489a3b.rlib /home/REDACTED/work/embedding/embedding/target/debug/deps/libunicode_ident-af7f0a7/home/REDACTED/work/embedding/embedding/target/debug/deps/libunicode_ident-af7f0a76d4392b05.rlib /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_64-u�� /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_64-REDACTED-linux-gnu/lib/librustc_literal_escaper-f3a22ebee540a516.rlib /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_64-REDACTED-linux-gnu/lib/libstd-d1237ef7159db0a2.rlib s-02�� dding/target/deboniguruma/src f9/out/a445302c6d3dcb51-unicode_fold1_key.o de/node/bin/as --gdwarf-4 x86-64.so.2 -o ofiling_procmacr-m64 (dns block)
  • Triggering command: /app/target/release/build/ort-sys-0136a8d5c67f5f15/build-script-main /app/target/release/build/ort-sys-0136a8d5c67f5f15/build-script-main oniguruma/src -w -DHAVE_UNISTD_H=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_TIME_H=1 .o r.o e.o o .o o o ax.o .o ion.o cf5a4af35e4501e2cc it.o .o (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)