Use Dangerzone directly in a docker compose setup

[dheldt]

Hi there,

I wan to use Dangerzone directly in a docker compose setup. First a container fetches mail, than dangerzone shall process attached pdfs and afterwards the documents are further processed.

Is there a way, that i use Dangerzone directly via docker and without gui?

thank you!

[almet]

Hi, it's possible to use dangerzone using a CLI yes! You can use the dangerzone-cli command for this. That being said, the interface to make the different containers work together doesn't currently exist.

The way dangerzone uses its containers is very specific, as we only allow some specific system calls. Doing containers in containers seem a simplest approach to me, in which you can run dangerzone-cli directly inside your container handling the mails, which would spin up a new container inside the first one to do the processing. Would that fit your needs?

[dheldt]

This sounds good. Thank you! Can you point me to the interface spec of dangerzone-cli and an installation guide? I am sorry, but I am quite new to dangerzone.

Btw: Thank you for the very fast reply!

[almet]

Happy to help :-) We'll need to document that better, actually! It's already installed with Dangerzone (it's embedded with it).

Here's what dangerzone-cli --help shows on my system:

Usage: dangerzone-cli [OPTIONS] [FILENAMES]...

Options:
  --output-filename TEXT        Default is filename ending with -safe.pdf
  --ocr-lang TEXT               Language to OCR, defaults to none
  --archive                     Archives the unsafe version in a subdirectory
                                named 'unsafe'
  --debug                       Run Dangerzone in debug mode, to get logs from
                                gVisor.
  --set-container-runtime TEXT  The name or full path of the container runtime
                                you want Dangerzone to use. You can specify
                                the value 'default' if you want to take back
                                your choice, and let Dangerzone use the
                                default runtime for this OS
  --version                     Show the version and exit.
  --help                        Show this message and exit.

[levonk]

First, thanks for your contributions!
Sorry I haven't looked at the code, I'm just trying to help quickly. If I had my druthers a docker compose would spin up a web interface with drag and drop, that can launch isolated containers to do the conversion using a mounted docker.sock best via https://github.com/nestybox/sysbox or https://github.com/wollomatic/socket-proxy . If it has to be a desktop app, a VNC wrapper could provide access until a web interface exists.

Thanks again, hope any of this was helpful.

[phillipredshirt]

@almet wrote: " Doing containers in containers seem a simplest approach to me"

If you're already using containers for this project, then wouldn't a docker compose stack be the way to go?

[apyrgio]

Normally yes, but in this case the Dangerzone CLI spawns a single, short-lived container per document conversion. Docker compose is more appropriate when you want to manage multiple containers as part of the same stack.

Note that we soon plan to factor out the container image into a separate repo and document its interface. Hopefully this will help other folks use Dangerzone in more creative ways, without messing with nested containers.