mirror of
https://github.com/data-privacy-stack/presidio.git
synced 2026-07-28 22:00:55 -05:00
f1689400f8
* fix: add non-root user to all Dockerfiles for security - Create dedicated user 'presidio' with UID 1001 in all Linux containers - Add USER directive to ensure containers don't run as root - Set proper file ownership with chown for production images - Apply same security fix to Windows containers using net user - Update sample Dockerfiles to follow security best practices This addresses the container security requirement that containers should not run with root privileges. * fix: configure Poetry to not use virtualenvs in containers When running as non-root user, Poetry was trying to create virtualenvs in the user's home directory, causing 'Command not found: gunicorn' errors. Setting POETRY_VIRTUALENVS_CREATE=false ensures Poetry installs packages system-wide (already isolated by the container), making them accessible to the non-root user at runtime. Tested locally with analyzer container - health and analyze endpoints working correctly. * fix: pre-install spaCy model in image-redactor for non-root user The image-redactor was attempting to install en_core_web_lg at runtime, which failed when running as non-root user due to write permission issues on system site-packages. Installing the model during Docker build (as root) ensures it's available system-wide for the non-root user to read and use at runtime. Using en_core_web_lg as the default model, which matches the presidio-analyzer default configuration. * fix: add POETRY_VIRTUALENVS_CREATE=false to Windows Dockerfiles Windows containers also need Poetry configured to install packages system-wide rather than in virtualenvs to ensure the non-root user can access the installed dependencies.