mirror of
https://github.com/ocrmypdf/OCRmyPDF.git
synced 2026-07-30 15:08:10 -04:00
ff45e54c07
Harden the Docker images by dropping root privileges, and make the bind-mount workflow less fiddly. - Create a non-root `app` user (uid/gid 1000) in both images and add `USER app` before the entrypoint, so ocrmypdf (and the webservice/watcher) no longer run as root. This also fixes the previously dangling `--chown=app:app`, which referenced a user that was never created. The Ubuntu base ships a default `ubuntu`/1000 user, so remove it first so `app` can take uid 1000 (parity with Alpine). - Add `WORKDIR /data` (created and app-owned) so bind-mounted input and output can be passed as relative paths without `--workdir`. The webservice/watcher are now invoked by absolute path (`/app/*.py`) since the working directory is no longer `/app`. - Drop the redundant `ppa:alex-p/tesseract-ocr5` from the Ubuntu image: Tesseract 5 ships in the Ubuntu archive as of 24.04, and the PPA had no build for the 26.04 base, which broke the build outright. - Rewrite docs/docker.md rootless-first: stdin/stdout piping as the recommended permission-free path, then per-runtime volume guidance (rootless Docker `--user 0:0`, Podman `--userns keep-id`, rootful Docker as the special case). Update batch.md and the compose example to match (absolute script paths, per-runtime `user:` guidance).
25 lines
929 B
YAML
25 lines
929 B
YAML
# SPDX-FileCopyrightText: 2022 James R. Barlow
|
|
# SPDX-License-Identifier: MIT
|
|
---
|
|
version: "3.3"
|
|
services:
|
|
ocrmypdf:
|
|
restart: always
|
|
container_name: ocrmypdf
|
|
image: jbarlow83/ocrmypdf-alpine
|
|
volumes:
|
|
- "/media/scan:/input"
|
|
- "/mnt/scan:/output"
|
|
environment:
|
|
- OCR_OUTPUT_DIRECTORY_YEAR_MONTH=0
|
|
# The image runs as the non-root "app" user (uid 1000) by default. The
|
|
# correct value here depends on your runtime, so that the watcher can write
|
|
# to the /output bind mount and the files end up owned by you:
|
|
# rootful Docker -> your host uid:gid
|
|
# rootless Docker -> "0:0" (container root maps to your host user)
|
|
# Podman -> your host uid:gid, plus `userns_mode: "keep-id"`
|
|
# See docs/docker.md ("Bind-mounted volumes") for the reasoning.
|
|
user: "<SET TO YOUR USER ID>:<SET TO YOUR GROUP ID>"
|
|
entrypoint: python3
|
|
command: /app/watcher.py
|