cesnimda
19c5251612
Run untrusted document decoders in a secret-free, resource-bounded child process and terminate its process tree on deadline. Harden the production container and enforce parser and lint gates in CI.
25 lines
940 B
Docker
25 lines
940 B
Docker
FROM python:3.12.10-slim-bookworm
|
|
ENV PIP_NO_CACHE_DIR=1 \
|
|
PIP_DISABLE_PIP_VERSION_CHECK=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
TRANSFORMERS_NO_TF=1 \
|
|
HF_HUB_DISABLE_TELEMETRY=1 \
|
|
HF_HOME=/home/app/.cache/huggingface \
|
|
PARSER_TEMP_ROOT=/tmp
|
|
WORKDIR /app
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends tesseract-ocr tesseract-ocr-eng \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
COPY requirements-linux.lock ./
|
|
RUN python -m pip install --upgrade pip setuptools wheel \
|
|
&& python -m pip install --require-hashes --extra-index-url https://download.pytorch.org/whl/cpu -r requirements-linux.lock
|
|
COPY . .
|
|
RUN groupadd --system app \
|
|
&& useradd --system --gid app --home-dir /home/app --create-home app \
|
|
&& mkdir -p /home/app/.cache/huggingface \
|
|
&& chown -R app:app /app /home/app
|
|
USER app
|
|
EXPOSE 8001
|
|
CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "8001"]
|