security(ocr): run OCR container as non-root user (CIS Docker §4.1) #611
@@ -56,6 +56,8 @@ async def lifespan(app: FastAPI):
|
||||
"""Load lightweight models at startup. Surya loads lazily on first request."""
|
||||
global _models_ready
|
||||
|
||||
if os.getuid() == 0:
|
||||
logger.warning("Running as root — CIS Docker §4.1 violation")
|
||||
logger.info("Loading Kraken model at startup (Surya loads lazily on first OCR request)...")
|
||||
kraken_engine.load_models()
|
||||
load_spell_checker()
|
||||
|
||||
Reference in New Issue
Block a user