From 1ccd70b1b7d42a1e2933a4e68074d6d6c97e4715 Mon Sep 17 00:00:00 2001 From: TomasPalsson Date: Mon, 28 Sep 2026 14:33:28 +0000 Subject: [PATCH] feat(runner): render office documents and OCR text in the sandbox Add LibreOffice headless (impress/writer/calc-nogui) plus tesseract OCR to the sandbox-build rootfs so nsjail'd code can convert pptx/docx/xlsx to PDF (and on to PNG with pdftoppm) and OCR images in eng+isl. The jail mounts /usr read-only but not /etc, so soffice's registry/psprint symlinks into /etc are replaced with real files, and the default profile is pointed at the session workspace so a plain `soffice --headless --convert-to pdf` works without an -env:UserInstallation flag. --- api/Dockerfile | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/api/Dockerfile b/api/Dockerfile index 21db33f6..a8f3682e 100644 --- a/api/Dockerfile +++ b/api/Dockerfile @@ -117,11 +117,28 @@ RUN apt-get update && \ libpango-1.0-0 \ libpangoft2-1.0-0 \ libharfbuzz-subset0 \ + # LibreOffice headless (soffice) renders office docs to PDF; tesseract is the OCR binary pytesseract needs. + libreoffice-impress-nogui \ + libreoffice-writer-nogui \ + libreoffice-calc-nogui \ + fonts-crosextra-carlito \ + fonts-crosextra-caladea \ + tesseract-ocr \ + tesseract-ocr-eng \ + tesseract-ocr-isl \ && rm -rf /var/lib/apt/lists/* \ && libffi=$(find /usr/lib -name 'libffi.so.8' -print -quit) \ && { [ -n "$libffi" ] || { echo "libffi.so.8 not found" >&2; exit 1; }; } \ && ln -sf "$libffi" "${libffi%.so.8}.so.6" +# The jail mounts /usr but not /etc, so soffice's symlinks into /etc abort +# with a UNO RuntimeException; ship real files instead, and default the +# profile to the session workspace (the jail's default profile path exits 77). +RUN cp --remove-destination /etc/libreoffice/registry/main.xcd /usr/lib/libreoffice/share/registry/main.xcd \ + && cp --remove-destination /etc/libreoffice/psprint.conf /usr/lib/libreoffice/share/psprint/psprint.conf \ + && sed -i 's#^UserInstallation=.*#UserInstallation=file:///mnt/data/.libreoffice#' /usr/lib/libreoffice/program/bootstraprc \ + && grep -qx 'UserInstallation=file:///mnt/data/.libreoffice' /usr/lib/libreoffice/program/bootstraprc + # Restore the standard Debian `awk` -> `mawk` symlink. mawk is Priority: # required so its binary is in /usr/bin already, but slim base images skip # the mawk postinst's `update-alternatives --install /usr/bin/awk awk