marcel/familienarchiv
1
0
Fork 0
Code Issues 103 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

security(ocr): run OCR container as non-root user (CIS Docker §4.1) #611

Merged
marcel merged 12 commits from feat/issue-459-ocr-non-root into main 2026-05-17 19:06:47 +02:00
Conversation 31 Commits 12 Files Changed 9 +8
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 1aca4c4a41 - Show all commits

8
ocr-service/Dockerfile
View File

@@ -23,8 +23,16 @@ RUN pip install --no-cache-dir -r requirements.txt
COPY . . COPY . .
RUN useradd --no-create-home --shell /usr/sbin/nologin --uid 1000 ocr \
&& mkdir -p /home/ocr /app/models /app/cache \
&& chown -R ocr:ocr /app /home/ocr
RUN chmod +x /app/entrypoint.sh RUN chmod +x /app/entrypoint.sh
ENV HOME=/home/ocr
ENV HF_HOME=/app/cache
USER ocr
EXPOSE 8000 EXPOSE 8000
CMD ["/app/entrypoint.sh"] CMD ["/app/entrypoint.sh"]