mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
SnapOtterandGitHub
e0dbf2a5c3
The container dropped privileges to the non-root snapotter user via gosu
(external) and s6-setuidgid (embedded), both of which preserve the
environment without setting HOME. The app therefore kept root's HOME=/root,
which is not writable by snapotter, and PaddleOCR died with
PermissionError: '/root/.paddlex/temp' -- breaking the ocr tool at default
quality in every non-root deployment. Prior GPU QA ran the app as root, which
masked it.
Fix: export HOME=/data/.home (persistent, writable, hidden) at every
privilege-drop point:
- entrypoint.sh external gosu path and non-root tini path (the latter uses
$DD/.home so a DATA_DIR override stays consistent).
- the s6 snapotter/run service (scoped there, not globally before /init, so
postgres/redis do not inherit a snapotter-owned HOME).
The root preflight creates /data/.home and the existing chown sweep owns it as
the PUID/PGID-remapped snapotter; the dir is added to both ensure_writable
probes so an unwritable HOME fails fast with the storage-permission guidance
instead of crashing late. The Dockerfile passwd home moves from /app
(read-only) to /data/.home as the getpwuid fallback when HOME is unset.
Because bridge.ts forwards HOME to the Python sidecar, this also repairs the
expanduser("~") caches in inpaint/outpaint/restore/noise_removal/remove_bg,
not just PaddleOCR.
Also fixes a test-harness inconsistency: tool-default-settings passport-photo
countryCode "us" -> "US" (the route exact-matches uppercase PASSPORT_SPECS
codes; the UI already sends "US", so users were never affected).
Claude-Session: https://claude.ai/code/session_01XGB4pGvTvb7sUX4JN745U7
44 lines
1.7 KiB
TypeScript
44 lines
1.7 KiB
TypeScript
/**
|
|
* Minimal valid settings per tool, used by the generated matrices
|
|
* (format-matrix-generated, hostile-inputs) when posting to tool routes.
|
|
*
|
|
* Default is {} (most schemas make every field optional). Tools whose schema
|
|
* rejects {} get an explicit minimal override here. The "defaults are valid"
|
|
* test in format-matrix-generated.test.ts safeParses every entry against the
|
|
* live schema, so a schema change that invalidates an entry fails at PR time
|
|
* and names the tool.
|
|
*/
|
|
export const TOOL_SETTINGS_OVERRIDES: Record<string, unknown> = {
|
|
resize: { width: 64 },
|
|
crop: { left: 0, top: 0, width: 50, height: 50 },
|
|
convert: { format: "png" },
|
|
"watermark-text": { text: "Test" },
|
|
"text-overlay": { text: "Test" },
|
|
"passport-photo": { countryCode: "US" },
|
|
"trim-video": { startS: 0, endS: 5 },
|
|
"trim-audio": { startS: 0, endS: 5 },
|
|
"split-pdf": { mode: "range", range: "1" },
|
|
"extract-pages": { range: "1" },
|
|
"remove-pages": { pages: "2" },
|
|
"organize-pdf": { order: "1-z" },
|
|
"protect-pdf": { userPassword: "test123" },
|
|
"unlock-pdf": { password: "test123" },
|
|
"watermark-pdf": { text: "CONFIDENTIAL" },
|
|
"redact-pdf": { terms: ["test"] },
|
|
"crop-video": { width: 32, height: 32 },
|
|
"rotate-video": { transform: "cw90" },
|
|
"resize-video": { preset: "720p" },
|
|
"watermark-video": { text: "CONFIDENTIAL" },
|
|
"audio-channels": { mode: "mono-to-stereo" },
|
|
"convert-document": { format: "odt" },
|
|
"epub-convert": { format: "html" },
|
|
"convert-presentation": { format: "odp" },
|
|
"convert-spreadsheet": { format: "ods" },
|
|
"content-aware-resize": { width: 50 },
|
|
"ai-canvas-expand": { extendRight: 32 },
|
|
};
|
|
|
|
export function defaultSettingsFor(toolId: string): unknown {
|
|
return TOOL_SETTINGS_OVERRIDES[toolId] ?? {};
|
|
}
|