asonix/pict-rs
1
1
Fork 1
Code Issues 2 Pull requests 3 Actions Projects Releases 133 Wiki Activity

Add imagemagick policy file for docker

Browse source 
Add note about imagemagick policy to readme
This commit is contained in:
asonix 2021-03-10 15:43:47 -06:00
parent e3dbd5e791
commit 949698f8d1
6 changed files with 58 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
README.md
View file

@ -4,7 +4,7 @@ _a simple image hosting service_
## Usage
### Running
```
pict-rs 0.2.0-alpha.3
pict-rs 0.2.6
USAGE:
pict-rs [FLAGS] [OPTIONS] --path <path>
@ -54,6 +54,11 @@ $ wget https://git.asonix.dog/asonix/pict-rs/raw/branch/master/docker/prod/docke
$ sudo docker-compose up -d
```
###### Note
- pict-rs makes use of the system's temporary folder. This is generally `/tmp` on linux
- pict-rs makes use of a default imagemagick security policy at
`/usr/local/lib/ImageMagick-$VERSION/config-Q16HDRI/policy.xml`
#### Docker Development
The development system loads a rust environment inside a docker container with the neccessary
dependencies already present

23
docker/dev/root/usr/local/lib/ImageMagick-7.0.11/config-Q16HDRI/policy.xml Normal file
View file

@ -0,0 +1,23 @@
<policymap>
<policy domain="resource" name="memory" value="256MiB" />
<policy domain="resource" name="list-length" value="32" />
<policy domain="resource" name="width" value="10KP" />
<policy domain="resource" name="height" value="10KP" />
<policy domain="resource" name="map" value="512MiB" />
<policy domain="resource" name="area" value="16KP" />
<policy domain="resource" name="disk" value="1GiB" />
<policy domain="resource" name="file" value="768" />
<policy domain="resource" name="thread" value="2" />
<policy domain="coder" rights="none" pattern="*" />
<policy domain="coder" rights="read | write" pattern="{GIF,JPEG,PNG,WEBP}" />
<policy domain="filter" rights="none" pattern="*" />
<policy domain="path" rights="none" pattern="@*" />
<policy domain="delegate" rights="none" pattern="*" />
<policy domain="module" rights="none" pattern="*" />
<policy domain="module" rights="read | write" pattern="{GIF,JPEG,PNG,WEBP}" />
<!-- indirect reads not permitted -->
<policy domain="cache" name="memory-map" value="anonymous" />
<policy domain="cache" name="synchronize" value="true" />
<policy domain="system" name="precision" value="6" />
<policy domain="system" name="shred" value="1" />
</policymap>

2
docker/prod/Dockerfile.amd64
View file

@ -219,6 +219,8 @@ ENV \
RUN \
chown pictrs:pictrs /mnt
COPY root/ /
VOLUME /mnt
WORKDIR /opt/pict-rs
USER pictrs

2
docker/prod/Dockerfile.arm32v7
View file

@ -220,6 +220,8 @@ ENV \
RUN \
chown pictrs:pictrs /mnt
COPY root/ /
VOLUME /mnt
WORKDIR /opt/pict-rs
USER pictrs

2
docker/prod/Dockerfile.arm64v8
View file

@ -220,6 +220,8 @@ ENV \
RUN \
chown pictrs:pictrs /mnt
COPY root/ /
VOLUME /mnt
WORKDIR /opt/pict-rs
USER pictrs

23
docker/prod/root/usr/local/lib/ImageMagick-7.0.11/config-Q16HDRI/policy.xml Normal file
View file

@ -0,0 +1,23 @@
<policymap>
<policy domain="resource" name="memory" value="256MiB" />
<policy domain="resource" name="list-length" value="32" />
<policy domain="resource" name="width" value="10KP" />
<policy domain="resource" name="height" value="10KP" />
<policy domain="resource" name="map" value="512MiB" />
<policy domain="resource" name="area" value="16KP" />
<policy domain="resource" name="disk" value="1GiB" />
<policy domain="resource" name="file" value="768" />
<policy domain="resource" name="thread" value="2" />
<policy domain="coder" rights="none" pattern="*" />
<policy domain="coder" rights="read | write" pattern="{GIF,JPEG,PNG,WEBP}" />
<policy domain="filter" rights="none" pattern="*" />
<policy domain="path" rights="none" pattern="@*" />
<policy domain="delegate" rights="none" pattern="*" />
<policy domain="module" rights="none" pattern="*" />
<policy domain="module" rights="read | write" pattern="{GIF,JPEG,PNG,WEBP}" />
<!-- indirect reads not permitted -->
<policy domain="cache" name="memory-map" value="anonymous" />
<policy domain="cache" name="synchronize" value="true" />
<policy domain="system" name="precision" value="6" />
<policy domain="system" name="shred" value="1" />
</policymap>