marcel/familienarchiv
1
0
Fork 0
Code Issues 107 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

security(ocr): add non-root user and set HOME/HF_HOME in Dockerfile

Browse Source 
CIS Docker §4.1: run uvicorn as UID 1000 (ocr) instead of root.
Creates /home/ocr and /app/cache with correct ownership so named
volumes inherit ocr:ocr on first Docker mount. Sets HOME and HF_HOME
so ~ expansion and Hugging Face caching resolve under /app, not /root.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Marcel
2026-05-17 16:46:25 +02:00
parent 669eaa7c65
commit 1aca4c4a41
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
ocr-service/Dockerfile
View File

@@ -23,8 +23,16 @@ RUN pip install --no-cache-dir -r requirements.txt
COPY . . COPY . .
RUN useradd --no-create-home --shell /usr/sbin/nologin --uid 1000 ocr \
&& mkdir -p /home/ocr /app/models /app/cache \
&& chown -R ocr:ocr /app /home/ocr
RUN chmod +x /app/entrypoint.sh RUN chmod +x /app/entrypoint.sh
ENV HOME=/home/ocr
ENV HF_HOME=/app/cache
USER ocr
EXPOSE 8000 EXPOSE 8000
CMD ["/app/entrypoint.sh"] CMD ["/app/entrypoint.sh"]