mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 19:56:53 +00:00
kevinveenbirkenbachandClaude Opus 5
942ca18b85
The image pulled both directions of every Argos pair because upstream's scripts/install_models.py matches a package when from_code AND to_code are both wanted, so a direction cannot be expressed through --load_only_lang_codes. prefetch_models.py now replaces that script instead of warming its cache, and takes --directions: `both` keeps the old set, `from_source` keeps only the pairs translating out of English, which halves the download for a deployment that never translates back. Replacing the script means carrying its guards. It refuses a language code no package offers and refuses an empty selection, and it hands MiniSBD the iso2model-converted codes rather than the raw ISO ones. Without those a typo would have built an image with fewer models, or none, and reported success. The build reaches the package cache over TLS, which needs the frontend CA in the image trust store. Rather than reimplement the installer in the Dockerfile, stage scripts/docker/cache/package-frontend/ca.sh into the build context and run it: it already picks the trust path per distribution, rebuilds the store and skips when no CA was staged. The trust-store path now exists in exactly one place. That step needs root. The base image sets USER libretranslate (uid 1032) and RUN inherits it, so update-ca-certificates fails with cannot create /etc/ssl/certs/ca-certificates.crt.new: Permission denied The CA layers therefore run as root and hand the user back before the model layers, so the models stay owned by the runtime user. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>