James R. Barlow
ff45e54c07
Harden the Docker images by dropping root privileges, and make the bind-mount workflow less fiddly. - Create a non-root `app` user (uid/gid 1000) in both images and add `USER app` before the entrypoint, so ocrmypdf (and the webservice/watcher) no longer run as root. This also fixes the previously dangling `--chown=app:app`, which referenced a user that was never created. The Ubuntu base ships a default `ubuntu`/1000 user, so remove it first so `app` can take uid 1000 (parity with Alpine). - Add `WORKDIR /data` (created and app-owned) so bind-mounted input and output can be passed as relative paths without `--workdir`. The webservice/watcher are now invoked by absolute path (`/app/*.py`) since the working directory is no longer `/app`. - Drop the redundant `ppa:alex-p/tesseract-ocr5` from the Ubuntu image: Tesseract 5 ships in the Ubuntu archive as of 24.04, and the PPA had no build for the 26.04 base, which broke the build outright. - Rewrite docs/docker.md rootless-first: stdin/stdout piping as the recommended permission-free path, then per-runtime volume guidance (rootless Docker `--user 0:0`, Podman `--userns keep-id`, rootful Docker as the special case). Update batch.md and the compose example to match (absolute script paths, per-runtime `user:` guidance).
97 lines
2.8 KiB
Docker
97 lines
2.8 KiB
Docker
# SPDX-FileCopyrightText: 2023 James R. Barlow
|
|
# SPDX-License-Identifier: MPL-2.0
|
|
|
|
FROM alpine:3.24 AS base
|
|
|
|
ENV LANG=C.UTF-8
|
|
ENV TZ=UTC
|
|
|
|
RUN apk add --no-cache \
|
|
python3 \
|
|
zlib
|
|
|
|
FROM base AS builder
|
|
|
|
# Yes it really is python3-dev, and py3-package
|
|
RUN apk add --no-cache \
|
|
ca-certificates \
|
|
git \
|
|
python3-dev \
|
|
py3-pyarrow \
|
|
curl
|
|
|
|
WORKDIR /app
|
|
|
|
COPY --from=ghcr.io/astral-sh/uv:0.11.21 /uv /uvx /bin/
|
|
|
|
ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy
|
|
|
|
RUN uv venv --system-site-packages .venv
|
|
|
|
# Install the project's dependencies using the lockfile and settings
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
--mount=type=bind,source=uv.lock,target=uv.lock \
|
|
--mount=type=bind,source=pyproject.toml,target=pyproject.toml \
|
|
uv sync --frozen --no-install-project --no-dev
|
|
|
|
# Then, add the rest of the project source code and install it
|
|
# Installing separately from its dependencies allows optimal layer caching
|
|
COPY . /app
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
uv sync --frozen \
|
|
--extra webservice --extra watcher --no-dev \
|
|
--no-install-package pyarrow
|
|
|
|
FROM base
|
|
|
|
RUN apk add --no-cache \
|
|
ghostscript \
|
|
jbig2dec \
|
|
jbig2enc \
|
|
pngquant \
|
|
tesseract-ocr \
|
|
tesseract-ocr-data-chi_sim \
|
|
tesseract-ocr-data-deu \
|
|
tesseract-ocr-data-eng \
|
|
tesseract-ocr-data-fra \
|
|
tesseract-ocr-data-osd \
|
|
tesseract-ocr-data-por \
|
|
tesseract-ocr-data-spa \
|
|
font-noto \
|
|
ttf-droid \
|
|
unpaper \
|
|
&& rm -rf /var/cache/apk/*
|
|
|
|
# Create a non-root user to run the application (defense in depth). The build
|
|
# stages above need root to install packages, but the entrypoint should not.
|
|
# A fixed uid/gid of 1000 keeps `--user`/`--userns keep-id` mappings predictable
|
|
# and matches the --chown below. See docs/docker.md for the volume/permissions
|
|
# implications under rootless vs rootful Docker.
|
|
RUN addgroup -g 1000 app \
|
|
&& adduser -u 1000 -G app -D -h /home/app app
|
|
ENV HOME=/home/app
|
|
|
|
WORKDIR /app
|
|
|
|
COPY --from=builder --chown=app:app /app /app
|
|
|
|
RUN rm -rf /app/.git && \
|
|
ln -s /app/misc/webservice.py /app/webservice.py && \
|
|
ln -s /app/misc/watcher.py /app/watcher.py && \
|
|
chown app:app /app
|
|
|
|
# Default working directory for bind-mounted data, so relative input/output
|
|
# paths work without passing --workdir (e.g. `-v "$PWD:/data" in.pdf out.pdf`).
|
|
# The webservice/watcher are run by absolute path (/app/*.py), unaffected by this.
|
|
RUN mkdir -p /data && chown app:app /data
|
|
WORKDIR /data
|
|
|
|
ENV PATH="/app/.venv/bin:${PATH}"
|
|
|
|
# Drop privileges: run the entrypoint (ocrmypdf, or the webservice/watcher when
|
|
# overridden) as the unprivileged app user. Override with `--user root` if you
|
|
# need root inside a running container (e.g. to apk add extra packages).
|
|
USER app
|
|
|
|
ENTRYPOINT ["/app/.venv/bin/ocrmypdf"]
|