# Pinned, CPU-only PDF parser image for untrusted PDFs.
#
# The base image is pinned by digest. Ubuntu packages come from the archive
# at build time, so a rebuild can change them; build.sh records the installed
# versions and the resulting image ID in image.lock.
FROM ubuntu:24.04@sha256:008173c23f95b170204355c12626cb5a965d779a7e1283b09e9cffbb1bf33ca3

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update \
 && apt-get install -y --no-install-recommends poppler-utils python3 \
 && rm -rf /var/lib/apt/lists/* /var/cache/apt

COPY isolation_probe.py parse.py /app/
COPY image.json /etc/pdf-parser-sandbox/image.json

RUN chmod 0444 /app/isolation_probe.py /app/parse.py /etc/pdf-parser-sandbox/image.json

ENV HOME=/tmp LANG=C.UTF-8 LC_ALL=C.UTF-8
USER 65534:65534
WORKDIR /tmp
