mirror of
https://github.com/guillaumemeyer/watermarks-remover.git
synced 2026-08-22 13:11:57 +02:00
Guillaume Meyer (The Opinionated Man)andGitHub
55d4bdc9fc
* feat: split skill from service, add HTTP API and Docker distribution The agent skill (skills/remove-ai-marks/) is now a code-free remote client: all implementation moved to service/scripts/ and runs behind a stdlib HTTP service (server.py) with /health, /capabilities, /inspect, /clean and a dynamically generated OpenAPI 3.0.3 spec at /openapi.json. - Move scripts/ and the backend Dockerfiles under service/ - server.py: JSON/base64 HTTP entrypoint with size caps, binary guard, atomic writes, loopback default, optional bearer auth - Core Dockerfile (exiftool/qpdf/c2patool preinstalled) and a GHCR publish workflow for the core/markllm/markdiffusion images - compose.yaml (wr-* services, harness/heavy profiles) + compose-check.sh to validate the running stack (exit code only) - Fix markllm image build (tokenizers 0.22.2, CPU-only torch) and ctrlregen build (python:3.11 base for the 2023-era research pins) - Fix markllm/markdiffusion harness images missing common.py at runtime * docs: add .env.example and service configuration guide * fix: disable chain-of-thought for openai-compatible Layer B rewrites deepseek-v4-flash is a reasoning model: a one-line paraphrase burned 9,894 reasoning tokens (~100s) and hit the default timeout. Send reasoning_effort=none by default for the openai-compatible backend (--reasoning-effort / WATERMARKS_REWRITE_REASONING_EFFORT; 'off' omits the parameter), cutting the same rewrite to ~1s / 12 tokens. Tested end-to-end against api.deepseek.com. * fix: sanitize client-supplied filename in HTTP service CodeQL 'uncontrolled data in path expression' (server.py): a name like '../../x' flowed into Path(tmpdir) / name, letting an upload escape the request temp dir on write. Sanitize name to its basename in _decode_input (_safe_name) and refuse any joined path whose parent is not the tmpdir at the write sites (_tmp_path). Tests cover traversal names. * chore: gitignore .env (contains local rewrite credentials) * chore: deny-by-default gitignore and dockerignore; document compose env config .gitignore and service/.dockerignore now exclude everything by default and explicitly allow only what is publishable/needed: tracked source, docs, tests, .github, and (for images) the service/scripts/ tree that every Dockerfile COPYs. Root .dockerignore documents that all builds use service/ as context. README Configuration section now covers .env setup for docker compose, host-side export for CLI runs, and the full variable table.
72 lines
2.8 KiB
Docker
72 lines
2.8 KiB
Docker
# Optional local Docker image for the MarkLLM text-watermark harness.
|
|
#
|
|
# Build from the repository root (build context = service/):
|
|
# docker build -f service/Dockerfile.markllm -t watermarks-remover-markllm service/
|
|
#
|
|
# The upstream code is fetched from source at build time and is NOT
|
|
# redistributed by this repository. Upstream is Apache-2.0.
|
|
#
|
|
# Vendored fork hardening:
|
|
# - base image pinned by digest (no moving tag drift)
|
|
# - upstream checkout pinned to a commit SHA (no moving branch)
|
|
# - deps pinned exactly in requirements-markllm.txt
|
|
# - pip itself pinned (no unpinned bootstrap step)
|
|
# - runs as an unprivileged user (a parser bug in a crafted file can no
|
|
# longer write files as root inside the container)
|
|
|
|
# Pinned upstream commit (2026-07-10). Keep in sync with setup_markllm.sh.
|
|
ARG MARKLLM_REF=c45ddc40f7b761beabe55a1b8dc4690e531d1c6d
|
|
|
|
# python:3.14-slim linux/amd64 digest.
|
|
FROM python:3.14-slim@sha256:ce40764625a4ff50df3548277632e7f96c4e77fe75fa848aae9885476e7df5a4
|
|
|
|
ARG MARKLLM_REF
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
git \
|
|
libgl1 \
|
|
libglib2.0-0 \
|
|
passwd \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN git clone --depth 1 --filter=blob:none --sparse \
|
|
https://github.com/THU-BPM/MarkLLM.git /opt/markllm \
|
|
&& cd /opt/markllm \
|
|
&& git fetch --depth 1 origin "${MARKLLM_REF}" \
|
|
&& git checkout --detach "${MARKLLM_REF}" \
|
|
&& git sparse-checkout set --no-cone \
|
|
'/watermark/' \
|
|
'/config/' \
|
|
'/utils/' \
|
|
'/exceptions/' \
|
|
'/evaluation/dataset.py' \
|
|
'/LICENSE' \
|
|
'/README.md' \
|
|
&& test "$(git -C /opt/markllm rev-parse HEAD)" = "${MARKLLM_REF}"
|
|
|
|
COPY scripts/requirements-markllm.txt /app/requirements-markllm.txt
|
|
COPY scripts/detect_text_watermark.py /app/detect_text_watermark.py
|
|
COPY scripts/common.py /app/common.py
|
|
|
|
# torch is installed first from the CPU index (like Dockerfile.markdiffusion);
|
|
# the remaining pinned deps then resolve against it. No GPU wheel index inside
|
|
# the image — CUDA users should run setup_markllm.sh on the host instead.
|
|
RUN python3 -m pip install --no-cache-dir "pip==26.2.1" \
|
|
&& python3 -m pip install --no-cache-dir --index-url https://download.pytorch.org/whl/cpu "torch>=2.13,<2.14" \
|
|
&& python3 -m pip install --no-cache-dir -r /app/requirements-markllm.txt
|
|
|
|
# Unprivileged runtime user. The harness only reads input files and writes to
|
|
# stdout, so nothing under /opt, /app, or the mounted data dir needs root.
|
|
RUN useradd --create-home --uid 10001 --shell /usr/sbin/nologin markllm
|
|
USER markllm
|
|
|
|
ENV MARKLLM_DIR=/opt/markllm \
|
|
HOME=/home/markllm \
|
|
PYTHONUNBUFFERED=1 \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
HF_HOME=/home/markllm/.cache/huggingface
|
|
|
|
WORKDIR /app
|
|
ENTRYPOINT ["python3", "/app/detect_text_watermark.py"]
|