mirror of
https://github.com/penpot/penpot.git
synced 2026-07-19 12:38:25 +00:00
b4532486e3
* 🐳 Add ImageMagick policy.xml resource limits to backend Docker image Add a restrictive policy.xml to the backend Docker image that caps ImageMagick resource usage: 256MiB memory, 512MiB map, 128MP area, 30s time limit, 16KP max dimensions. Blocks PS/EPS/PDF/XPS coders to prevent Ghostscript attack surface. Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * ✨ Add timeout support to shell/exec! Add optional :timeout parameter (in seconds) that uses Process.waitFor(long, TimeUnit). On timeout, the process is destroyed forcibly and an :internal/:process-timeout exception is raised. Stdout/stderr readers handle IOException from closed streams when the process is killed. Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * ♻️ Rename ::wrk/netty-executor to ::wrk/executor with cached pool Replace DefaultEventExecutorGroup (fixed Netty thread pool) with a cached thread pool (px/cached-executor) for general async task offloading. The cached pool creates threads on demand and reuses idle ones, which is more appropriate for blocking I/O workloads (shell commands, message bus, rate limiting, etc.). Changes: - Rename ::wrk/netty-executor to ::wrk/executor in worker/executor.clj - Switch implementation from DefaultEventExecutorGroup to px/cached-executor - Update all ig/ref wiring in main.clj (msgbus, tmp cleaner, climit, rlimit, rpc) - Remove ::wrk/netty-executor from redis.clj (let lettuce create its own eventExecutorGroup instead of sharing a Netty executor) - Assert executor is present in shell/exec! to prevent silent nil usage - Remove executor-threads config (no longer needed for cached pool) The ::wrk/netty-io-executor (NioEventLoopGroup) remains unchanged as it handles actual non-blocking network I/O for Redis and S3. Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * 🔥 Remove im4java dependency and replace with direct ImageMagick CLI calls - Replace im4java Java library with direct 'magick' CLI calls via shell/exec! - Add PENPOT_IMAGEMAGICK_* config env vars for resource limits (thread, memory, map, area, disk, time, width, height) - Use configurable ImageMagick environment with sensible defaults matching policy.xml - Remove -Dim4java.useV7=true JVM flag from startup scripts - Remove org.im4java/im4java from deps.edn - All ImageMagick commands now use shell/exec! with 60s timeout and resource limits Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * 💄 Rename imagemagick env functions and optimize config reads - Rename imagemagick-defaults -> imagemagick-default-env - Rename imagemagick-env -> get-imagemagick-env - Optimize to avoid double cf/get calls per config key Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * ✨ Add tests for shell/exec! timeout and media processing - Add shell_test.clj: tests for exec! timeout, env vars, stdin, stderr - Add media_test.clj: tests for info, generic-thumbnail, profile-thumbnail - Fix generic-process to prefer explicit format over input mtype - Fix shell/exec! to use cached executor when system has no executor - Fix reduce-kv accumulator in set-env (must return penv) Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * ♻️ Refactor media/process to take system as first argument - Change (defmulti process :cmd) -> (defmulti process (fn [_system params] (:cmd params))) - Change (run params) -> (run system params) - All process methods now receive [system params] - Update all callers: rpc/commands/media, profile, auth, fonts - Revert shell/exec! to require system with executor (no fallback) - Fix lint warnings and formatting Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * 🔥 Remove unused app.svgo namespace Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * 🔥 Remove Node.js from backend Docker image - Delete unused svgo-cli.js script - Remove Node.js installation from Dockerfile.backend - Remove svgo-cli.js copy from backend build script Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * 🔥 Remove unused process-error multimethod - Remove process-error multimethod and its default handler - Simplify media/run to directly call process - Fix alignment in main.clj Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> * 📚 Add ImageMagick resource limits configuration to technical guide Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app> --------- Co-authored-by: mimo-v2.5-pro <mimo-v2.5-pro@penpot.app>
106 lines
3.4 KiB
Clojure
106 lines
3.4 KiB
Clojure
{:mvn/repos
|
|
{"sonatype" {:url "https://oss.sonatype.org/content/repositories/snapshots/"}}
|
|
|
|
:deps
|
|
{penpot/common {:local/root "../common"}
|
|
org.clojure/clojure {:mvn/version "1.12.5"}
|
|
org.clojure/tools.namespace {:mvn/version "1.5.1"}
|
|
|
|
com.github.luben/zstd-jni {:mvn/version "1.5.7-10"}
|
|
|
|
io.prometheus/simpleclient {:mvn/version "0.16.0"}
|
|
io.prometheus/simpleclient_hotspot {:mvn/version "0.16.0"}
|
|
io.prometheus/simpleclient_jetty
|
|
{:mvn/version "0.16.0"
|
|
:exclusions [org.eclipse.jetty/jetty-server
|
|
org.eclipse.jetty/jetty-servlet]}
|
|
|
|
io.prometheus/simpleclient_httpserver {:mvn/version "0.16.0"}
|
|
|
|
io.lettuce/lettuce-core {:mvn/version "7.6.0.RELEASE"}
|
|
;; Minimal dependencies required by lettuce, we need to include them
|
|
;; explicitly because clojure dependency management does not support
|
|
;; yet the BOM format.
|
|
io.micrometer/micrometer-core {:mvn/version "1.14.2"}
|
|
io.micrometer/micrometer-observation {:mvn/version "1.14.2"}
|
|
|
|
java-http-clj/java-http-clj {:mvn/version "0.4.3"}
|
|
com.google.guava/guava {:mvn/version "33.6.0-jre"}
|
|
|
|
funcool/yetti
|
|
{:git/tag "v11.10"
|
|
:git/sha "88701f4"
|
|
:git/url "https://github.com/funcool/yetti.git"
|
|
:exclusions [org.slf4j/slf4j-api]}
|
|
|
|
com.github.seancorfield/next.jdbc
|
|
{:mvn/version "1.3.1108"}
|
|
|
|
metosin/reitit-core {:mvn/version "0.10.1"}
|
|
nrepl/nrepl {:mvn/version "1.7.0"}
|
|
|
|
org.postgresql/postgresql {:mvn/version "42.7.11"}
|
|
org.xerial/sqlite-jdbc {:mvn/version "3.53.2.0"}
|
|
|
|
com.zaxxer/HikariCP {:mvn/version "7.0.2"}
|
|
|
|
io.whitfin/siphash {:mvn/version "2.0.0"}
|
|
|
|
buddy/buddy-hashers {:mvn/version "2.0.167"}
|
|
buddy/buddy-sign {:mvn/version "3.6.1-359"}
|
|
|
|
com.github.ben-manes.caffeine/caffeine {:mvn/version "3.2.4"}
|
|
|
|
org.jsoup/jsoup {:mvn/version "1.22.2"}
|
|
|
|
at.yawk.lz4/lz4-java
|
|
{:mvn/version "1.11.0"}
|
|
|
|
org.clojars.pntblnk/clj-ldap {:mvn/version "0.0.17"}
|
|
|
|
dawran6/emoji {:mvn/version "0.2.0"}
|
|
markdown-clj/markdown-clj {:mvn/version "1.12.8"}
|
|
|
|
;; Pretty Print specs
|
|
pretty-spec/pretty-spec {:mvn/version "0.1.4"}
|
|
software.amazon.awssdk/s3 {:mvn/version "2.46.7"}
|
|
software.amazon.awssdk/sts {:mvn/version "2.46.7"}}
|
|
|
|
:paths ["src" "resources" "target/classes"]
|
|
:aliases
|
|
{:dev
|
|
{:extra-deps
|
|
{com.bhauman/rebel-readline {:mvn/version "0.1.7"}
|
|
clojure-humanize/clojure-humanize {:mvn/version "0.2.2"}
|
|
org.clojure/data.csv {:mvn/version "1.1.1"}
|
|
com.clojure-goes-fast/clj-async-profiler {:mvn/version "2.0.0-beta1"}
|
|
mockery/mockery {:mvn/version "0.1.4"}}
|
|
:extra-paths ["test" "dev"]}
|
|
|
|
:build
|
|
{:extra-deps
|
|
{io.github.clojure/tools.build {:mvn/version "0.10.14"}}
|
|
:ns-default build}
|
|
|
|
:test
|
|
{:main-opts ["-m" "kaocha.runner"]
|
|
:jvm-opts ["-Dlog4j2.configurationFile=log4j2-devenv-repl.xml"
|
|
"--sun-misc-unsafe-memory-access=allow"
|
|
"--enable-native-access=ALL-UNNAMED"]
|
|
:extra-deps {lambdaisland/kaocha {:mvn/version "1.91.1392"}}}
|
|
|
|
:outdated
|
|
{:extra-deps {com.github.liquidz/antq {:mvn/version "2.11.1276"}}
|
|
:main-opts ["-m" "antq.core"]}
|
|
|
|
:jmx-remote
|
|
{:jvm-opts ["-Dcom.sun.management.jmxremote"
|
|
"-Dcom.sun.management.jmxremote.port=9000"
|
|
"-Dcom.sun.management.jmxremote.rmi.port=9000"
|
|
"-Dcom.sun.management.jmxremote.local.only=false"
|
|
"-Dcom.sun.management.jmxremote.authenticate=false"
|
|
"-Dcom.sun.management.jmxremote.ssl=false"
|
|
"-Djava.rmi.server.hostname=localhost"]}
|
|
|
|
}}
|