security(ocr): run OCR container as non-root user (CIS Docker §4.1) #611

Merged
marcel merged 12 commits from feat/issue-459-ocr-non-root into main 2026-05-17 19:06:47 +02:00
2 changed files with 26 additions and 1 deletions
Showing only changes of commit 9db42d6cc1 - Show all commits

View File

@@ -24,7 +24,7 @@ log = logging.getLogger(__name__)
BLLA_MODEL_PATH = os.environ.get("BLLA_MODEL_PATH", "/app/models/blla.mlmodel")
# DOI for "General segmentation model for print and handwriting" — ketos 7 compatible.
BLLA_MODEL_DOI = "10.5281/zenodo.14602569"
HTRMOPO_DIR = os.path.expanduser("~/.local/share/htrmopo")
HTRMOPO_DIR = os.environ.get("HTRMOPO_DIR", "/app/models/.htrmopo")
def _model_is_loadable(path: str) -> bool:

View File

@@ -1,10 +1,35 @@
"""Unit tests for ensure_blla_model.main()."""
import importlib
import os
from unittest.mock import MagicMock, call, patch
import ensure_blla_model
# ─── HTRMOPO_DIR env var resolution ──────────────────────────────────────────
def test_htrmopo_dir_reads_from_env_var():
"""HTRMOPO_DIR uses the HTRMOPO_DIR env var when set, not ~ expansion."""
with patch.dict(os.environ, {"HTRMOPO_DIR": "/custom/htrmopo"}):
importlib.reload(ensure_blla_model)
result = ensure_blla_model.HTRMOPO_DIR
importlib.reload(ensure_blla_model)
assert result == "/custom/htrmopo"
def test_htrmopo_dir_default_is_fixed_path():
"""Default HTRMOPO_DIR is a fixed path not derived from ~ (no-create-home safe)."""
clean_env = {k: v for k, v in os.environ.items() if k != "HTRMOPO_DIR"}
with patch.dict(os.environ, clean_env, clear=True):
importlib.reload(ensure_blla_model)
result = ensure_blla_model.HTRMOPO_DIR
importlib.reload(ensure_blla_model)
assert "~" not in result
assert not result.startswith("/.")
# ─── Model already loadable ───────────────────────────────────────────────────