Route HF caches to /tmp and create writable cache dirs; keep nginx/supervisord non-root safe

Dockerfile

@@ -38,7 +38,13 @@ FROM python:3.11-slim AS runtime
 ENV PYTHONUNBUFFERED=1 PIP_NO_CACHE_DIR=1 PORT=7860 \
     PATH="/opt/venv/bin:${PATH}" \
     MPLCONFIGDIR=/tmp 
-
+ENV HOME=/tmp \
+    XDG_CACHE_HOME=/tmp/.cache \
+    HF_HOME=/tmp/.cache/huggingface \
+    HF_HUB_CACHE=/tmp/.cache/huggingface/hub \
+    HF_DATASETS_CACHE=/tmp/.cache/huggingface/datasets \
+    TRANSFORMERS_CACHE=/tmp/.cache/huggingface/transformers \
+    MPLCONFIGDIR=/tmp
 WORKDIR /app
 
 # 依賴
@@ -47,7 +53,12 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libgomp1 libopenblas0 \
  && rm -rf /var/lib/apt/lists/*
 
-RUN install -d -m 0777 /tmp/nginx/client_body /tmp/nginx/proxy /tmp/nginx/fastcgi /tmp/nginx/uwsgi /tmp/nginx/scgi
+RUN install -d -m 0777 \
+    /tmp/.cache \
+    /tmp/.cache/huggingface/hub \
+    /tmp/.cache/huggingface/datasets \
+    /tmp/.cache/huggingface/transformers \
+    /tmp/nginx/client_body /tmp/nginx/proxy /tmp/nginx/fastcgi /tmp/nginx/uwsgi /tmp/nginx/scgi
 
 # 建立可寫暫存
 RUN mkdir -p /tmp/nginx/client_body /tmp/nginx/proxy /tmp/nginx/fastcgi /tmp/nginx/uwsgi /tmp/nginx/scgi \