EDCOCR-PUBLIC/Dockerfile at main · magnet78/EDCOCR-PUBLIC · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
ARG BASE_IMAGE=python:3.11-slim

FROM ${BASE_IMAGE} AS runtime-base

ENV PADDLE_HOME=/app/.paddle
ENV PADDLEOCR_HOME=/app/.paddleocr
ENV CUDA_VISIBLE_DEVICES=""
ENV PYTHONUNBUFFERED=1

RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    ca-certificates \
    curl \
    fonts-noto-core \
    ghostscript \
    libgl1 \
    libglib2.0-0 \
    libgomp1 \
    libzbar0 \
    poppler-utils \
    tesseract-ocr \
    && rm -rf /var/lib/apt/lists/*

# ---------------------------------------------------------------------------
# Noto Sans fonts for searchable-PDF text layer embedding (font_selector.py)
# ---------------------------------------------------------------------------
# Symlink non-CJK fonts installed by fonts-noto-core into the app font dir.
RUN mkdir -p /app/fonts/noto && \
    for f in \
        NotoSans-Regular.ttf \
        NotoSansArabic-Regular.ttf \
        NotoSansDevanagari-Regular.ttf \
        NotoSansTamil-Regular.ttf \
        NotoSansTelugu-Regular.ttf \
        NotoSansKannada-Regular.ttf \
        NotoSansGeorgian-Regular.ttf \
        NotoSansThai-Regular.ttf \
        NotoSansBengali-Regular.ttf; \
    do \
        [ -f "/usr/share/fonts/truetype/noto/$f" ] && \
            ln -sf "/usr/share/fonts/truetype/noto/$f" "/app/fonts/noto/$f"; \
    done

# Download individual CJK OTF files (the Debian fonts-noto-cjk package only
# provides a .ttc collection, not individual .otf files needed by font_selector).
# Pinned to commit f8d1575 for reproducible builds (SEC-017 / ).
# Air-gapped deployment: pre-stage these files in a local fonts/ directory and
# replace the curl commands below with:
#   COPY fonts/NotoSansCJK*.otf /app/fonts/noto/
RUN curl -fSL "https://github.com/notofonts/noto-cjk/raw/f8d157532fbfaeda587e826d4cd5b21a49186f7c/Sans/OTF/SimplifiedChinese/NotoSansCJKsc-Regular.otf" \
         -o /app/fonts/noto/NotoSansCJKsc-Regular.otf && \
    curl -fSL "https://github.com/notofonts/noto-cjk/raw/f8d157532fbfaeda587e826d4cd5b21a49186f7c/Sans/OTF/TraditionalChinese/NotoSansCJKtc-Regular.otf" \
         -o /app/fonts/noto/NotoSansCJKtc-Regular.otf && \
    curl -fSL "https://github.com/notofonts/noto-cjk/raw/f8d157532fbfaeda587e826d4cd5b21a49186f7c/Sans/OTF/Japanese/NotoSansCJKjp-Regular.otf" \
         -o /app/fonts/noto/NotoSansCJKjp-Regular.otf && \
    curl -fSL "https://github.com/notofonts/noto-cjk/raw/f8d157532fbfaeda587e826d4cd5b21a49186f7c/Sans/OTF/Korean/NotoSansCJKkr-Regular.otf" \
         -o /app/fonts/noto/NotoSansCJKkr-Regular.otf

RUN mkdir -p \
    /app/models \
    /app/ocr_source \
    /app/ocr_output \
    /app/ocr_output/logs \
    /app/ocr_temp \
    /app/.paddle \
    /app/.paddleocr

WORKDIR /app

RUN pip install --no-cache-dir --upgrade pip

FROM runtime-base AS model-preload

RUN pip install --no-cache-dir \
    paddlepaddle \
    paddleocr

COPY download_models.py /tmp/download_models.py
# Use --cpu-only to force use_gpu=False and avoid CUDA probe segfault
# during the build stage (no GPU drivers available in build containers).
# SKIP_MODEL_PRELOAD=1 can be set to skip download entirely.
ARG SKIP_MODEL_PRELOAD=0
RUN SKIP_MODEL_PRELOAD=${SKIP_MODEL_PRELOAD} \
    python3 /tmp/download_models.py --cpu-only && rm /tmp/download_models.py

FROM runtime-base

# Bake refreshed model caches into the final runtime image.
COPY --from=model-preload /app/.paddle /app/.paddle
COPY --from=model-preload /app/.paddleocr /app/.paddleocr

# Download FastText language identification model (126MB)
# Used by detect_language for multi-language OCR routing
ADD https://dl.fbaipublicfiles.com/fasttext/supervised-models/lid.176.bin /app/models/lid.176.bin

COPY requirements.txt /app/requirements.txt
RUN pip install --no-cache-dir -r /app/requirements.txt
RUN pip install --no-cache-dir --upgrade "setuptools>=82,<83" "wheel>=0.46.3,<0.47"

# ---------------------------------------------------------------------------
# Remove build-essential from runtime image ( / INFRA-002)
# gcc/g++/make are only needed for compiling C extensions during pip install;
# the compiled .so files remain but the toolchain is stripped to reduce
# image size (~200MB) and CVE surface area.
# ---------------------------------------------------------------------------
RUN apt-get update && apt-get purge -y --auto-remove build-essential && \
    rm -rf /var/lib/apt/lists/*

COPY *.py /app/
COPY api/ /app/api/
COPY ocr_distributed/ /app/ocr_distributed/
COPY ocr_local/ /app/ocr_local/
COPY reprocess/ /app/reprocess/
COPY schemas/ /app/schemas/
COPY --chmod=755 healthcheck.sh /app/healthcheck.sh

# ---------------------------------------------------------------------------
# Non-root runtime user (SEC-003)
# ---------------------------------------------------------------------------
RUN groupadd -r -g 1000 ocr && \
    useradd -r -u 1000 -g ocr -d /home/ocr -s /sbin/nologin ocr && \
    mkdir -p /home/ocr && \
    touch /app/ocr_healthcheck && \
    chown -R ocr:ocr /app/ocr_output /app/ocr_temp /app/ocr_source \
                      /app/.paddle /app/.paddleocr /app/models \
                      /app/ocr_healthcheck /home/ocr

USER ocr

HEALTHCHECK --interval=30s --timeout=5s --start-period=120s --retries=3 \
    CMD /app/healthcheck.sh

CMD ["python3", "-u", "/app/ocr_gpu_async.py"]