# syntax=docker/dockerfile:1
# Converter image: LibreOffice (headless, no GUI packages) and Ghostscript on Debian 13.
# The base is pinned by digest, and packages come from the Debian snapshot of the same week,
# so a rebuild installs the same versions. Move both together, at least monthly: converters
# get security fixes often.
FROM debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f
ARG SNAPSHOT=20261011T000000Z
RUN sed -i \
      -e "s|http://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${SNAPSHOT}|" \
      -e "s|http://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${SNAPSHOT}|" \
      /etc/apt/sources.list.d/debian.sources \
 && apt-get -o Acquire::Check-Valid-Until=false update \
 && apt-get install -y --no-install-recommends \
      libreoffice-writer-nogui libreoffice-calc-nogui ghostscript fonts-dejavu-core \
 && rm -rf /var/lib/apt/lists/*
# A fixed non-root user; the worker also passes --user 10001:10001.
RUN useradd --uid 10001 --user-group --no-create-home --home-dir /tmp converter
USER 10001:10001
WORKDIR /tmp
