mirror of
https://github.com/penpot/penpot.git
synced 2026-07-19 12:38:25 +00:00
b4532486e3
* 🐳 Add ImageMagick policy.xml resource limits to backend Docker image Add a restrictive policy.xml to the backend Docker image that caps ImageMagick resource usage: 256MiB memory, 512MiB map, 128MP area, 30s time limit, 16KP max dimensions. Blocks PS/EPS/PDF/XPS coders to prevent Ghostscript attack surface. Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * ✨ Add timeout support to shell/exec! Add optional :timeout parameter (in seconds) that uses Process.waitFor(long, TimeUnit). On timeout, the process is destroyed forcibly and an :internal/:process-timeout exception is raised. Stdout/stderr readers handle IOException from closed streams when the process is killed. Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * ♻️ Rename ::wrk/netty-executor to ::wrk/executor with cached pool Replace DefaultEventExecutorGroup (fixed Netty thread pool) with a cached thread pool (px/cached-executor) for general async task offloading. The cached pool creates threads on demand and reuses idle ones, which is more appropriate for blocking I/O workloads (shell commands, message bus, rate limiting, etc.). Changes: - Rename ::wrk/netty-executor to ::wrk/executor in worker/executor.clj - Switch implementation from DefaultEventExecutorGroup to px/cached-executor - Update all ig/ref wiring in main.clj (msgbus, tmp cleaner, climit, rlimit, rpc) - Remove ::wrk/netty-executor from redis.clj (let lettuce create its own eventExecutorGroup instead of sharing a Netty executor) - Assert executor is present in shell/exec! to prevent silent nil usage - Remove executor-threads config (no longer needed for cached pool) The ::wrk/netty-io-executor (NioEventLoopGroup) remains unchanged as it handles actual non-blocking network I/O for Redis and S3. Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * 🔥 Remove im4java dependency and replace with direct ImageMagick CLI calls - Replace im4java Java library with direct 'magick' CLI calls via shell/exec! - Add PENPOT_IMAGEMAGICK_* config env vars for resource limits (thread, memory, map, area, disk, time, width, height) - Use configurable ImageMagick environment with sensible defaults matching policy.xml - Remove -Dim4java.useV7=true JVM flag from startup scripts - Remove org.im4java/im4java from deps.edn - All ImageMagick commands now use shell/exec! with 60s timeout and resource limits Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * 💄 Rename imagemagick env functions and optimize config reads - Rename imagemagick-defaults -> imagemagick-default-env - Rename imagemagick-env -> get-imagemagick-env - Optimize to avoid double cf/get calls per config key Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * ✨ Add tests for shell/exec! timeout and media processing - Add shell_test.clj: tests for exec! timeout, env vars, stdin, stderr - Add media_test.clj: tests for info, generic-thumbnail, profile-thumbnail - Fix generic-process to prefer explicit format over input mtype - Fix shell/exec! to use cached executor when system has no executor - Fix reduce-kv accumulator in set-env (must return penv) Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * ♻️ Refactor media/process to take system as first argument - Change (defmulti process :cmd) -> (defmulti process (fn [_system params] (:cmd params))) - Change (run params) -> (run system params) - All process methods now receive [system params] - Update all callers: rpc/commands/media, profile, auth, fonts - Revert shell/exec! to require system with executor (no fallback) - Fix lint warnings and formatting Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * 🔥 Remove unused app.svgo namespace Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * 🔥 Remove Node.js from backend Docker image - Delete unused svgo-cli.js script - Remove Node.js installation from Dockerfile.backend - Remove svgo-cli.js copy from backend build script Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * 🔥 Remove unused process-error multimethod - Remove process-error multimethod and its default handler - Simplify media/run to directly call process - Fix alignment in main.clj Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * 📚 Add ImageMagick resource limits configuration to technical guide Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> --------- Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app>
113 lines
3.2 KiB
Docker
113 lines
3.2 KiB
Docker
FROM ubuntu:24.04 AS build
|
|
LABEL maintainer="Penpot <docker@penpot.app>"
|
|
|
|
ENV LANG='C.UTF-8' \
|
|
LC_ALL='C.UTF-8' \
|
|
JAVA_HOME="/opt/jdk" \
|
|
DEBIAN_FRONTEND=noninteractive \
|
|
TZ=Etc/UTC
|
|
|
|
RUN set -ex; \
|
|
apt-get -qq update; \
|
|
apt-get -qq upgrade; \
|
|
apt-get -qqy --no-install-recommends install \
|
|
binutils \
|
|
ca-certificates \
|
|
curl \
|
|
; \
|
|
apt-get clean; \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN set -eux; \
|
|
ARCH="$(dpkg --print-architecture)"; \
|
|
case "${ARCH}" in \
|
|
aarch64|arm64) \
|
|
ESUM='cc1b459dc442d7422b46a3b5fe52acaea54879fa7913e29a05650cef54687f5f'; \
|
|
BINARY_URL='https://cdn.azul.com/zulu/bin/zulu26.30.11-ca-jdk26.0.1-linux_aarch64.tar.gz'; \
|
|
;; \
|
|
amd64|x86_64) \
|
|
ESUM='7d6663ea8d4298df65de065e32f9f449745ff607d30ba5d13777cb92e9d4613d'; \
|
|
BINARY_URL='https://cdn.azul.com/zulu/bin/zulu26.30.11-ca-jdk26.0.1-linux_x64.tar.gz'; \
|
|
;; \
|
|
*) \
|
|
echo "Unsupported arch: ${ARCH}"; \
|
|
exit 1; \
|
|
;; \
|
|
esac; \
|
|
curl -LfsSo /tmp/openjdk.tar.gz ${BINARY_URL}; \
|
|
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
|
|
mkdir -p /opt/jdk; \
|
|
cd /opt/jdk; \
|
|
tar -xf /tmp/openjdk.tar.gz --strip-components=1; \
|
|
rm -rf /tmp/openjdk.tar.gz; \
|
|
/opt/jdk/bin/jlink \
|
|
--no-header-files \
|
|
--no-man-pages \
|
|
--strip-debug \
|
|
--add-modules java.base,jdk.net,jdk.management.agent,java.se,jdk.compiler,jdk.javadoc,jdk.attach,jdk.unsupported,jdk.jfr,jdk.jcmd \
|
|
--output /opt/jre;
|
|
|
|
FROM ubuntu:24.04 AS image
|
|
LABEL maintainer="Penpot <docker@penpot.app>"
|
|
|
|
ENV LANG='C.UTF-8' \
|
|
LC_ALL='C.UTF-8' \
|
|
JAVA_HOME="/opt/jre" \
|
|
PATH=/opt/jre/bin:/opt/imagick/bin:$PATH \
|
|
DEBIAN_FRONTEND=noninteractive \
|
|
TZ=Etc/UTC
|
|
|
|
RUN set -ex; \
|
|
useradd -U -M -u 1001 -s /bin/false -d /opt/penpot penpot; \
|
|
apt-get -qq update; \
|
|
apt-get -qq upgrade; \
|
|
apt-get -qqy --no-install-recommends install \
|
|
ca-certificates \
|
|
curl \
|
|
fontconfig \
|
|
fontforge \
|
|
libfontconfig1 \
|
|
libfreetype6 \
|
|
libglib2.0-0 \
|
|
libgomp1 \
|
|
libheif1 \
|
|
libjpeg-turbo8 \
|
|
liblcms2-2 \
|
|
libopenexr-3-1-30 \
|
|
libopenjp2-7 \
|
|
libpng16-16 \
|
|
librsvg2-2 \
|
|
libtiff6 \
|
|
libwebp7 \
|
|
libwebpdemux2 \
|
|
libwebpmux3 \
|
|
libxml2 \
|
|
libzip4t64 \
|
|
libzstd1 \
|
|
python3 \
|
|
python3-tabulate \
|
|
tzdata \
|
|
woff-tools \
|
|
woff2 \
|
|
; \
|
|
find tmp/usr/share/zoneinfo/* -type d ! -name 'Etc' |xargs rm -rf; \
|
|
apt-get clean; \
|
|
rm -rf /var/lib /var/cache; \
|
|
rm -rf /usr/include; \
|
|
mkdir -p /opt/data/assets; \
|
|
mkdir -p /opt/penpot; \
|
|
chown -R penpot:penpot /opt/penpot; \
|
|
chown -R penpot:penpot /opt/data;
|
|
|
|
COPY --from=build /opt/jre /opt/jre
|
|
COPY --from=penpotapp/imagemagick:7.1.2-13 /opt/imagick /opt/imagick
|
|
|
|
COPY files/imagemagick-policy.xml /opt/imagick/etc/ImageMagick-7/policy.xml
|
|
|
|
ARG BUNDLE_PATH="./bundle-backend/"
|
|
COPY --chown=penpot:penpot $BUNDLE_PATH /opt/penpot/backend/
|
|
|
|
USER penpot:penpot
|
|
WORKDIR /opt/penpot/backend
|
|
CMD ["/bin/bash", "run.sh"]
|