security(ocr): run OCR container as non-root user (CIS Docker §4.1) #611
@@ -87,9 +87,11 @@ services:
|
||||
memswap_limit: 12g
|
||||
volumes:
|
||||
- ocr_models:/app/models
|
||||
- ocr_cache:/app/cache
|
||||
- ocr_cache:/app/cache # HuggingFace / ketos cache — prevents re-downloads on recreate (HF_HOME)
|
||||
environment:
|
||||
HF_HOME: /app/cache
|
||||
XDG_CACHE_HOME: /app/cache
|
||||
TORCH_HOME: /app/models/torch
|
||||
KRAKEN_MODEL_PATH: /app/models/german_kurrent.mlmodel
|
||||
TRAINING_TOKEN: "${OCR_TRAINING_TOKEN:-}"
|
||||
OCR_CONFIDENCE_THRESHOLD: "0.3"
|
||||
|
||||
@@ -30,6 +30,8 @@ RUN chmod +x /app/entrypoint.sh
|
||||
|
||||
ENV HOME=/home/ocr
|
||||
ENV HF_HOME=/app/cache
|
||||
ENV XDG_CACHE_HOME=/app/cache
|
||||
ENV TORCH_HOME=/app/models/torch
|
||||
|
||||
USER ocr
|
||||
|
||||
|
||||
Reference in New Issue
Block a user