marcel/familienarchiv
1
0
Fork 0
Code Issues 107 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

security(ocr): run OCR container as non-root user (CIS Docker §4.1) #611

Merged
marcel merged 12 commits from feat/issue-459-ocr-non-root into main 2026-05-17 19:06:47 +02:00
Conversation 31 Commits 12 Files Changed 9 +10 -1
2 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit bead6f1811 - Show all commits

2
ocr-service/ensure_blla_model.py
View File

@@ -24,7 +24,7 @@ log = logging.getLogger(__name__)
BLLA_MODEL_PATH = os.environ.get("BLLA_MODEL_PATH", "/app/models/blla.mlmodel")
# DOI for "General segmentation model for print and handwriting" — ketos 7 compatible.
BLLA_MODEL_DOI = "10.5281/zenodo.14602569"
HTRMOPO_DIR = os.environ.get("HTRMOPO_DIR", "/app/models/.htrmopo")
HTRMOPO_DIR = os.environ.get("HTRMOPO_DIR") or "/app/models/.htrmopo"
def _model_is_loadable(path: str) -> bool:

9
ocr-service/test_ensure_blla_model.py
View File

@@ -29,6 +29,15 @@ def test_htrmopo_dir_default_is_fixed_path():
assert result == "/app/models/.htrmopo"
def test_htrmopo_dir_falls_back_to_default_when_set_to_empty_string():
"""HTRMOPO_DIR='' must not produce an empty path — get() returns '' for blank env vars."""
with patch.dict(os.environ, {"HTRMOPO_DIR": ""}):
importlib.reload(ensure_blla_model)
result = ensure_blla_model.HTRMOPO_DIR
importlib.reload(ensure_blla_model)
assert result != ""
# ─── Model already loadable ───────────────────────────────────────────────────