cleanup

Dockerfile

@@ -8,7 +8,7 @@ ARG NEED_MIRROR=0
 WORKDIR /ragflow
 
 # copy models downloaded via download_deps.py
-RUN mkdir -p /ragflow/rag/res/deepdoc /root/.ragflow
+RUN mkdir -p /ragflow/rag/res/deepdoc /opt/ragflow_home
 RUN --mount=type=bind,from=infiniflow/ragflow_deps:latest,source=/huggingface.co,target=/huggingface.co \
     tar --exclude='.*' -cf - \
         /huggingface.co/InfiniFlow/text_concat_xgb_v1.0 \
@@ -18,12 +18,15 @@ RUN --mount=type=bind,from=infiniflow/ragflow_deps:latest,source=/huggingface.co
 # https://github.com/chrismattmann/tika-python
 # This is the only way to run python-tika without internet access. Without this set, the default is to check the tika version and pull latest every time from Apache.
 RUN --mount=type=bind,from=infiniflow/ragflow_deps:latest,source=/,target=/deps \
-    cp -r /deps/nltk_data /root/ && \
+    mkdir -p /opt/nltk_data && \
+    cp -r /deps/nltk_data/* /opt/nltk_data/ && \
     cp /deps/tika-server-standard-3.3.0.jar /deps/tika-server-standard-3.3.0.jar.md5 /ragflow/ && \
     cp /deps/cl100k_base.tiktoken /ragflow/9b5ad71b2ce5302211f9c61530b329a4922fc6a4
 
+ENV TIKTOKEN_CACHE_DIR=/ragflow
 ENV TIKA_SERVER_JAR="file:///ragflow/tika-server-standard-3.3.0.jar"
 ENV DEBIAN_FRONTEND=noninteractive
+ENV NLTK_DATA=/opt/nltk_data
 
 # Setup apt
 # Python package and implicit dependencies:
@@ -35,15 +38,30 @@ RUN --mount=type=cache,id=ragflow_apt,target=/var/cache/apt,sharing=locked \
     apt update && \
     apt --no-install-recommends install -y ca-certificates; \
     if [ "$NEED_MIRROR" == "1" ]; then \
-        sed -i 's|http://archive.ubuntu.com/ubuntu|https://mirrors.aliyun.com/ubuntu|g' /etc/apt/sources.list.d/ubuntu.sources; \
-        sed -i 's|http://security.ubuntu.com/ubuntu|https://mirrors.aliyun.com/ubuntu|g' /etc/apt/sources.list.d/ubuntu.sources; \
+        sed -i 's|http://archive.ubuntu.com/ubuntu|https://mirrors.tuna.tsinghua.edu.cn/ubuntu|g' /etc/apt/sources.list.d/ubuntu.sources; \
+        sed -i 's|http://security.ubuntu.com/ubuntu|https://mirrors.tuna.tsinghua.edu.cn/ubuntu|g' /etc/apt/sources.list.d/ubuntu.sources; \
     fi; \
     rm -f /etc/apt/apt.conf.d/docker-clean && \
     echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache && \
     chmod 1777 /tmp && \
     apt update && \
-    apt install -y \
-    build-essential libglib2.0-0 libglx-mesa0 libgl1 pkg-config libicu-dev libgdiplus default-jdk libatk-bridge2.0-0 libpython3-dev libgtk-4-1 libnss3 xdg-utils libgbm-dev libjemalloc-dev gnupg unzip curl wget git vim less ghostscript pandoc texlive texlive-latex-extra texlive-xetex texlive-lang-chinese fonts-freefont-ttf fonts-noto-cjk postgresql-client
+    apt install -y build-essential && \
+    apt install -y libglib2.0-0 libglx-mesa0 libgl1 && \
+    apt install -y pkg-config libicu-dev libgdiplus && \
+    apt install -y default-jdk && \
+    apt install -y libatk-bridge2.0-0 && \
+    apt install -y libpython3-dev libgtk-4-1 libnss3 xdg-utils libgbm-dev && \
+    apt install -y libjemalloc-dev && \
+    apt install -y gnupg unzip curl wget git vim less && \
+    apt install -y ghostscript && \
+    apt install -y pandoc && \
+    apt install -y texlive && \
+    apt install -y fonts-freefont-ttf fonts-noto-cjk && \
+    apt install -y postgresql-client
+
+RUN wget -q -O /ragflow/9b5ad71b2ce5302211f9c61530b329a4922fc6a4 \
+    https://openaipublic.blob.core.windows.net/encodings/cl100k_base.tiktoken && \
+    echo "tiktoken cl100k_base encoding cached successfully"
 
 # Download resource from GitHub to /usr/share/infinity
 RUN mkdir -p /usr/share/infinity/resource && \
@@ -77,13 +95,16 @@ RUN --mount=type=bind,from=infiniflow/ragflow_deps:latest,source=/,target=/deps
     if [ "$arch" = "x86_64" ]; then uv_arch="x86_64"; else uv_arch="aarch64"; fi; \
     tar xzf "/deps/uv-${uv_arch}-unknown-linux-gnu.tar.gz" \
     && cp "uv-${uv_arch}-unknown-linux-gnu/"* /usr/local/bin/ \
-    && rm -rf "uv-${uv_arch}-unknown-linux-gnu" \
-    && uv python install 3.12
+    && rm -rf "uv-${uv_arch}-unknown-linux-gnu"
+
+
+
+ENV UV_PYTHON_INSTALL_DIR=/opt/uv/python
+RUN uv python install 3.12
 
 ENV PYTHONDONTWRITEBYTECODE=1 DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1 \
     UV_HTTP_TIMEOUT=200 \
     UV_HTTP_RETRIES=3
-ENV PATH=/root/.local/bin:$PATH
 
 # nodejs 12.22 on Ubuntu 22.04 is too old
 RUN --mount=type=cache,id=ragflow_apt,target=/var/cache/apt,sharing=locked \
@@ -148,14 +169,21 @@ RUN --mount=type=cache,id=ragflow_uv,target=/root/.cache/uv,sharing=locked \
         sed -i 's|mirrors.aliyun.com/pypi|pypi.org|g' uv.lock; \
     fi; \
     uv sync --python 3.12 --frozen && \
-    # Ensure pip is available in the venv for runtime package installation (fixes #12651)
     .venv/bin/python3 -m ensurepip --upgrade
+    # Ensure pip is available in the venv for runtime package installation (fixes #12651)
+
+# Pre-install docling at build time (runtime install impossible in airgapped environments)
+ARG DOCLING_VERSION=2.71.0
+RUN --mount=type=cache,id=ragflow_uv,target=/root/.cache/uv,sharing=locked \
+    uv pip install --no-cache-dir "docling==${DOCLING_VERSION}" easyocr
+
+RUN .venv/bin/docling-tools models download --all -o /ragflow/docling_models
 
 COPY web web
 COPY docs docs
 RUN --mount=type=cache,id=ragflow_npm,target=/root/.npm,sharing=locked \
-    cd web && NODE_OPTIONS="--max-old-space-size=8192" npm install && \
-    NODE_OPTIONS="--max-old-space-size=8192" VITE_BUILD_SOURCEMAP=false VITE_MINIFY=esbuild npm run build
+    export NODE_OPTIONS="--max-old-space-size=4096" && \
+    cd web && npm install && npm run build
 
 COPY .git /ragflow/.git
 
@@ -173,7 +201,9 @@ WORKDIR /ragflow
 # Copy Python environment and packages
 ENV VIRTUAL_ENV=/ragflow/.venv
 COPY --from=builder ${VIRTUAL_ENV} ${VIRTUAL_ENV}
-ENV PATH="${VIRTUAL_ENV}/bin:${PATH}"
+COPY --from=builder /ragflow/docling_models /ragflow/docling_models
+ENV DOCLING_ARTIFACTS_PATH="/ragflow/docling_models"
+ENV PATH="${VIRTUAL_ENV}/bin:/usr/local/bin:/usr/bin:/bin"
 
 ENV PYTHONPATH=/ragflow/
 
@@ -205,4 +235,48 @@ RUN mv /etc/nginx/ragflow.conf.golang /etc/nginx/conf.d/ragflow.conf.golang && \
 COPY --from=builder /ragflow/web/dist /ragflow/web/dist
 
 COPY --from=builder /ragflow/VERSION /ragflow/VERSION
+
+# =============================================================================
+# OPENSHIFT RESTRICTED-V2 COMPATIBILITY
+# =============================================================================
+
+RUN rm -rf /root/nltk_data /root/.ragflow 2>/dev/null || true
+
+# 2. Configure nginx for non-root:
+RUN sed -i -E 's/listen\s+80(\s|;)/listen 8080\1/g' /etc/nginx/conf.d/*.conf* /etc/nginx/conf.d/* 2>/dev/null || true && \
+    sed -i 's|pid\s\+/var/run/nginx.pid|pid /tmp/nginx.pid|g' /etc/nginx/nginx.conf && \
+    grep -q '^\s*pid ' /etc/nginx/nginx.conf || sed -i '1i pid /tmp/nginx.pid;' /etc/nginx/nginx.conf && \
+    echo 'client_body_temp_path /tmp/nginx_client_body;' > /etc/nginx/conf.d/00-temp-paths.conf && \
+    echo 'proxy_temp_path /tmp/nginx_proxy;' >> /etc/nginx/conf.d/00-temp-paths.conf && \
+    echo 'fastcgi_temp_path /tmp/nginx_fastcgi;' >> /etc/nginx/conf.d/00-temp-paths.conf && \
+    echo 'uwsgi_temp_path /tmp/nginx_uwsgi;' >> /etc/nginx/conf.d/00-temp-paths.conf && \
+    echo 'scgi_temp_path /tmp/nginx_scgi;' >> /etc/nginx/conf.d/00-temp-paths.conf
+
+# 3. Set HOME to /tmp 
+ENV HOME=/tmp
+
+# 4. Set group ownership to GID 0 and mirror permissions 
+RUN chgrp -R 0 /ragflow \
+                /opt/nltk_data \
+                /opt/ragflow_home \
+                /opt/chrome \
+                /opt/uv \
+                /var/log/nginx \
+                /var/cache/nginx \
+                /var/run \
+                /etc/nginx \
+    && chmod -R g=u /ragflow \
+                    /opt/nltk_data \
+                    /opt/ragflow_home \
+                    /opt/chrome \
+                    /opt/uv \
+                    /var/log/nginx \
+                    /var/cache/nginx \
+                    /var/run \
+                    /etc/nginx \
+    && chmod -R g=u /tmp
+
+# 5. Set non-root user
+USER 1000
+
 ENTRYPOINT ["./entrypoint.sh"]

docker/.env

@@ -192,7 +192,7 @@ TEI_HOST=tei
 TEI_PORT=6380
 
 # The local time zone.
-TZ=Asia/Shanghai
+TZ=${TZ:-Europe/Berlin}
 
 # Uncomment the following line if you have limited access to huggingface.co:
 # HF_ENDPOINT=https://hf-mirror.com
@@ -237,7 +237,7 @@ EMBEDDING_BATCH_SIZE=${EMBEDDING_BATCH_SIZE:-16}
 # A user registration switch:
 # - Enable registration: 1
 # - Disable registration: 0
-REGISTER_ENABLED=1
+REGISTER_ENABLED=${REGISTER_ENABLED:-0}
 
 # Important: To enable sandbox, you need to uncomment following two lines:
 # SANDBOX_ENABLED=1
@@ -267,7 +267,7 @@ SANDBOX_ARTIFACT_BUCKET=sandbox-artifacts
 SANDBOX_ARTIFACT_EXPIRE_DAYS=7
 
 # Enable DocLing
-USE_DOCLING=false
+USE_DOCLING=${USE_DOCLING:-true}
 
 # Enable Mineru
 # Uncommenting these lines will automatically add MinerU to the model provider whenever possible.

helm/templates/_helpers.tpl

@@ -84,4 +84,4 @@ Create the name of the service account to use
 {{- else }}
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
-{{- end }}
+{{- end }}

helm/templates/elasticsearch.yaml

@@ -53,28 +53,6 @@ spec:
         {{- toYaml . | nindent 8 }}
         {{- end }}
       {{- end }}
-      initContainers:
-      - name: fix-data-volume-permissions
-        image: {{ include "ragflow.imageRepo" (dict "root" . "repo" .Values.elasticsearch.initContainers.alpine.repository) }}:{{ .Values.elasticsearch.initContainers.alpine.tag }}
-        {{- with .Values.elasticsearch.initContainers.alpine.pullPolicy }}
-        imagePullPolicy: {{ . }}
-        {{- end }}
-        command:
-        - sh
-        - -c
-        - "chown -R 1000:0 /usr/share/elasticsearch/data"
-        volumeMounts:
-          - mountPath: /usr/share/elasticsearch/data
-            name: es-data
-      - name: sysctl
-        image: {{ include "ragflow.imageRepo" (dict "root" . "repo" .Values.elasticsearch.initContainers.busybox.repository) }}:{{ .Values.elasticsearch.initContainers.busybox.tag }}
-        {{- with .Values.elasticsearch.initContainers.busybox.pullPolicy }}
-        imagePullPolicy: {{ . }}
-        {{- end }}
-        securityContext:
-          privileged: true
-          runAsUser: 0
-        command: ["sysctl", "-w", "vm.max_map_count=262144"]
       containers:
       - name: elasticsearch
         image: {{ include "ragflow.imageRepo" (dict "root" . "repo" .Values.elasticsearch.image.repository) }}:{{ .Values.elasticsearch.image.tag }}
@@ -98,15 +76,6 @@ spec:
         resources:
           {{- . | toYaml | nindent 10 }}
         {{- end }}
-        securityContext:
-          capabilities:
-            add:
-              - "IPC_LOCK"
-          runAsUser: 1000
-          # NOTE: fsGroup doesn't seem to
-          # work so use init container instead
-          # fsGroup: 1000
-          allowPrivilegeEscalation: false
       volumes:
         - name: es-data
           persistentVolumeClaim:

helm/templates/env.yaml

@@ -1,63 +1,46 @@
-{{- /*
-TODO: Split env vars into separate secrets so that each pod
-      only gets passed the secrets it really needs.
-*/}}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "ragflow.fullname" . }}-env-config
+  name: {{ include "ragflow.fullname" . }}
 type: Opaque
 stringData:
   {{- range $key, $val := .Values.env }}
   {{- if and $val (ne $key "MYSQL_HOST") (ne $key "MYSQL_PORT") (ne $key "MYSQL_USER") (ne $key "MYSQL_PASSWORD") (ne $key "MINIO_HOST") (ne $key "MINIO_PORT") (ne $key "MINIO_PASSWORD") (ne $key "REDIS_HOST") (ne $key "REDIS_PORT") (ne $key "REDIS_PASSWORD") (ne $key "ELASTIC_PASSWORD") (ne $key "OPENSEARCH_PASSWORD") }}
   {{ $key }}: {{ quote $val }}
   {{- end }}
   {{- end }}
-  {{- /*
-  Use host names derived from internal cluster DNS
-  */}}
   {{- if .Values.redis.enabled }}
-  REDIS_HOST: {{ printf "%s-redis.%s.svc" (include "ragflow.fullname" .) .Release.Namespace }}
+  REDIS_HOST: {{ printf "%s" .Values.env.REDIS_HOST }}
   REDIS_PORT: "6379"
   {{- else }}
-  REDIS_HOST: {{ required "env.REDIS_HOST is required when redis.enabled=false" .Values.env.REDIS_HOST | quote }}
+  REDIS_HOST: {{ printf "%s" .Values.env.REDIS_HOST }}
   REDIS_PORT: {{ default "6379" .Values.env.REDIS_PORT | quote }}
   {{- end }}
   {{- if .Values.mysql.enabled }}
-  MYSQL_HOST: {{ printf "%s-mysql.%s.svc" (include "ragflow.fullname" .) .Release.Namespace }}
+  MYSQL_HOST: {{ printf "%s" .Values.env.MYSQL_HOST }}
   MYSQL_PORT: "3306"
   {{- else }}
-  MYSQL_HOST: {{ required "env.MYSQL_HOST is required when mysql.enabled=false" .Values.env.MYSQL_HOST | quote }}
+  MYSQL_HOST: {{ printf "%s" .Values.env.MYSQL_HOST }}
   MYSQL_PORT: {{ default "3306" .Values.env.MYSQL_PORT | quote }}
   MYSQL_USER: {{ default "root" .Values.env.MYSQL_USER | quote }}
   {{- end }}
   {{- if .Values.minio.enabled }}
-  MINIO_HOST: {{ printf "%s-minio.%s.svc" (include "ragflow.fullname" .) .Release.Namespace }}
+  MINIO_HOST: {{ printf "%s" .Values.env.MINIO_HOST }}
   MINIO_PORT: "9000"
   {{- else }}
-  MINIO_HOST: {{ default "" .Values.env.MINIO_HOST | quote }}
+  MINIO_HOST: {{ printf "%s" .Values.env.MINIO_HOST }}
   MINIO_PORT: {{ default "9000" .Values.env.MINIO_PORT | quote }}
   {{- end }}
-  {{- /*
-  Fail if passwords are not provided in release values
-  */}}
   REDIS_PASSWORD: {{ default "" .Values.env.REDIS_PASSWORD }}
-  {{- /*
-  NOTE: MySQL uses MYSQL_ROOT_PASSWORD env var but Ragflow container expects
-  MYSQL_PASSWORD so we need to define both as the same value here.
-  */}}
   {{- with .Values.env.MYSQL_PASSWORD | required "MYSQL_PASSWORD is required" }}
   MYSQL_PASSWORD: {{ . }}
   MYSQL_ROOT_PASSWORD: {{ . }}
   {{- end }}
   {{- $minioPass := default "" .Values.env.MINIO_PASSWORD }}
   MINIO_PASSWORD: {{ $minioPass }}
   MINIO_ROOT_PASSWORD: {{ $minioPass }}
-  {{- /*
-  Only provide env vars for enabled doc engine
-  */}}
   {{- if eq .Values.env.DOC_ENGINE "elasticsearch" }}
-  ES_HOST: {{ printf "%s-es.%s.svc" (include "ragflow.fullname" .) .Release.Namespace }}
+  ES_HOST: {{ printf "%s" .Values.env.ES_HOST }}
   ELASTIC_PASSWORD: {{ .Values.env.ELASTIC_PASSWORD | required "ELASTIC_PASSWORD is required" }}
   {{- else if eq .Values.env.DOC_ENGINE "infinity" }}
   INFINITY_HOST: {{ printf "%s-infinity.%s.svc" (include "ragflow.fullname" .) .Release.Namespace }}

helm/templates/infinity.yaml

@@ -60,7 +60,7 @@ spec:
         {{- end }}
         envFrom:
           - secretRef:
-              name: {{ include "ragflow.fullname" . }}-env-config
+              name: {{ include "ragflow.fullname" . }}
         ports:
           - containerPort: 23817
             name: thrift

helm/templates/minio.yaml

@@ -61,7 +61,7 @@ spec:
         {{- end }}
         envFrom:
           - secretRef:
-              name: {{ include "ragflow.fullname" . }}-env-config
+              name: {{ include "ragflow.fullname" . }}
         args:
           - server
           - "--console-address=:9001"

helm/templates/mysql.yaml

@@ -27,6 +27,7 @@ metadata:
     {{- include "ragflow.labels" . | nindent 4 }}
     app.kubernetes.io/component: mysql
 spec:
+  serviceName: {{ include "ragflow.fullname" . }}-mysql
   replicas: 1
   selector:
     matchLabels:
@@ -62,15 +63,15 @@ spec:
         {{- end }}
         envFrom:
           - secretRef:
-              name: {{ include "ragflow.fullname" . }}-env-config
+              name: {{ include "ragflow.fullname" . }}
         args:
           - --max_connections=1000
           - --character-set-server=utf8mb4
           - --collation-server=utf8mb4_general_ci
-          - --default-authentication-plugin=mysql_native_password
+          - --authentication_policy=caching_sha2_password
           - --tls_version=TLSv1.2,TLSv1.3
-          - --init-file=/data/application/init.sql
           - --disable-log-bin
+          - --host_cache_size=0
         ports:
           - containerPort: 3306
             name: mysql
@@ -81,7 +82,8 @@ spec:
         volumeMounts:
           - mountPath: /var/lib/mysql
             name: mysql-data
-          - mountPath: /data/application/init.sql
+            subPath: data
+          - mountPath: /docker-entrypoint-initdb.d/init.sql
             subPath: init.sql
             readOnly: true
             name: init-script-volume
@@ -108,5 +110,5 @@ spec:
     - protocol: TCP
       port: 3306
       targetPort: mysql
-  type: {{ .Values.mysql.service.type }}
+  type: {{ .Values.mysql.service.type | default "ClusterIP" }}
 {{- end }}

helm/templates/opensearch.yaml

@@ -83,7 +83,7 @@ spec:
         {{- end }}
         envFrom:
           - secretRef:
-              name: {{ include "ragflow.fullname" . }}-env-config
+              name: {{ include "ragflow.fullname" . }}
           - configMapRef:
               name: {{ include "ragflow.fullname" . }}-opensearch-config
         ports: