Skip to content
GitLab
Explore
Sign in
Register
Primary navigation
Search or go to…
Project
D
docker-ebookserver
Manage
Activity
Members
Labels
Plan
Issues
Issue boards
Milestones
Wiki
Redmine
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Build
Pipelines
Jobs
Pipeline schedules
Artifacts
Deploy
Releases
Container Registry
Model registry
Operate
Environments
Monitor
Incidents
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Terms and privacy
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
Aaron Andreas
docker-ebookserver
Commits
4f329885
Commit
4f329885
authored
6 years ago
by
root
Browse files
Options
Downloads
Patches
Plain Diff
initial commit
parent
d8a49f4a
No related branches found
Branches containing commit
No related tags found
No related merge requests found
Changes
2
Hide whitespace changes
Inline
Side-by-side
Showing
2 changed files
Dockerfile
+35
-0
35 additions, 0 deletions
Dockerfile
policy.xml
+78
-0
78 additions, 0 deletions
policy.xml
with
113 additions
and
0 deletions
Dockerfile
0 → 100644
+
35
−
0
View file @
4f329885
FROM
python:2.7
# create a non-root user
RUN
groupadd
-g
999 appuser
&&
\
useradd
-r
-u
999
-g
appuser appuser
RUN
mkdir
-p
/app /ebooks
WORKDIR
/app
# get GIT, then clone current master of calibre-web
RUN
apt-get update
RUN
apt-get
-y
install
git
RUN
git clone https://github.com/janeczku/calibre-web.git /app
# install the requirements
RUN
pip
install
-r
requirements.txt
# install the optional stuff
RUN
pip
install
-r
optional-requirements.txt
# install lxml
RUN
pip
install
lxml
# install imagemagick from debian
RUN
apt-get
install
-y
imagemagick
# install policy.xml into /etc/ImageMagick
COPY
policy.xml /etc/ImageMagick-6/policy.xml
# fix some permissions
RUN
chown
-R
appuser /app
EXPOSE
8083/tcp
USER
appuser
CMD
python cps.py
This diff is collapsed.
Click to expand it.
policy.xml
0 → 100644
+
78
−
0
View file @
4f329885
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policymap [
<!ELEMENT policymap (policy)+>
<!ELEMENT policy (#PCDATA)>
<!ATTLIST policy domain (delegate|coder|filter|path|resource) #IMPLIED>
<!ATTLIST policy name CDATA #IMPLIED>
<!ATTLIST policy rights CDATA #IMPLIED>
<!ATTLIST policy pattern CDATA #IMPLIED>
<!ATTLIST policy value CDATA #IMPLIED>
]>
<!--
Configure ImageMagick policies.
Domains include system, delegate, coder, filter, path, or resource.
Rights include none, read, write, and execute. Use | to combine them,
for example: "read | write" to permit read from, or write to, a path.
Use a glob expression as a pattern.
Suppose we do not want users to process MPEG video images:
<policy domain="delegate" rights="none" pattern="mpeg:decode" />
Here we do not want users reading images from HTTP:
<policy domain="coder" rights="none" pattern="HTTP" />
Lets prevent users from executing any image filters:
<policy domain="filter" rights="none" pattern="*" />
The /repository file system is restricted to read only. We use a glob
expression to match all paths that start with /repository:
<policy domain="path" rights="read" pattern="/repository/*" />
Let's prevent possible exploits by removing the right to use indirect reads.
<policy domain="path" rights="none" pattern="@*" />
Any large image is cached to disk rather than memory:
<policy domain="resource" name="area" value="1GB"/>
Define arguments for the memory, map, area, width, height, and disk resources
with SI prefixes (.e.g 100MB). In addition, resource policies are maximums
for each instance of ImageMagick (e.g. policy memory limit 1GB, -limit 2GB
exceeds policy maximum so memory limit is 1GB).
-->
<policymap>
<!-- <policy domain="resource" name="temporary-path" value="/tmp"/> -->
<policy
domain=
"resource"
name=
"memory"
value=
"256MiB"
/>
<policy
domain=
"resource"
name=
"map"
value=
"512MiB"
/>
<policy
domain=
"resource"
name=
"width"
value=
"16KP"
/>
<policy
domain=
"resource"
name=
"height"
value=
"16KP"
/>
<policy
domain=
"resource"
name=
"area"
value=
"128MB"
/>
<policy
domain=
"resource"
name=
"disk"
value=
"1GiB"
/>
<!-- <policy domain="resource" name="file" value="768"/> -->
<!-- <policy domain="resource" name="thread" value="4"/> -->
<!-- <policy domain="resource" name="throttle" value="0"/> -->
<!-- <policy domain="resource" name="time" value="3600"/> -->
<!-- <policy domain="system" name="precision" value="6"/> -->
<!-- not needed due to the need to use explicitly by mvg: -->
<!-- <policy domain="delegate" rights="none" pattern="MVG" /> -->
<!-- use curl -->
<policy
domain=
"delegate"
rights=
"none"
pattern=
"URL"
/>
<policy
domain=
"delegate"
rights=
"none"
pattern=
"HTTPS"
/>
<policy
domain=
"delegate"
rights=
"none"
pattern=
"HTTP"
/>
<!-- in order to avoid to get image with password text -->
<policy
domain=
"path"
rights=
"none"
pattern=
"@*"
/>
<policy
domain=
"cache"
name=
"shared-secret"
value=
"passphrase"
stealth=
"true"
/>
<!-- disable ghostscript format types -->
<policy
domain=
"coder"
rights=
"none"
pattern=
"PS"
/>
<policy
domain=
"coder"
rights=
"none"
pattern=
"EPI"
/>
<policy
domain=
"coder"
rights=
"read"
pattern=
"PDF"
/>
<policy
domain=
"coder"
rights=
"none"
pattern=
"XPS"
/>
</policymap>
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment