Skip to content

[CLAUDE] wkhtmltopdfをaptではなくバイナリから直接インストールするように変更 #378

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kinoppyd merged 1 commit into from
Apr 13, 2026
+7 −1
Merged

[CLAUDE] wkhtmltopdfをaptではなくバイナリから直接インストールするように変更 #378

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,15 @@ WORKDIR /rails

# Install base packages
RUN apt-get update -qq && \
apt-get install --no-install-recommends -y curl libjemalloc2 libvips sqlite3 wkhtmltopdf fonts-noto-cjk fonts-noto-color-emoji && \
apt-get install --no-install-recommends -y curl libjemalloc2 libvips sqlite3 fonts-noto-cjk fonts-noto-color-emoji && \
rm -rf /var/lib/apt/lists /var/cache/apt/archives

# Install wkhtmltopdf from binary (not available via apt on Debian Trixie)
RUN curl -fsSL https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6.1-3/wkhtmltox_0.12.6.1-3.bookworm_amd64.deb -o /tmp/wkhtmltox.deb && \
Comment on lines 21 to +23
Copy link

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The downloaded .deb is installed without any integrity verification. Please pin and validate the artifact (e.g., verify a published SHA256 checksum or signature) to reduce supply-chain risk and avoid silently installing a tampered binary if the URL is ever compromised.

Suggested change
# Install wkhtmltopdf from binary (not available via apt on Debian Trixie)
RUN curl -fsSL https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6.1-3/wkhtmltox_0.12.6.1-3.bookworm_amd64.deb -o /tmp/wkhtmltox.deb && \
ARG WKHTMLTOX_DEB_SHA256=<published_sha256_for_wkhtmltox_0.12.6.1-3.bookworm_amd64.deb>
# Install wkhtmltopdf from binary (not available via apt on Debian Trixie)
RUN curl -fsSL https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6.1-3/wkhtmltox_0.12.6.1-3.bookworm_amd64.deb -o /tmp/wkhtmltox.deb && \
echo "${WKHTMLTOX_DEB_SHA256} /tmp/wkhtmltox.deb" | sha256sum -c - && \

Copilot uses AI. Check for mistakes.
Comment on lines +22 to +23
Copy link

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This hard-codes the Bookworm amd64 package, which will fail when building on arm64 (common on Apple Silicon) or when using buildx multi-platform builds. Consider selecting the download URL based on TARGETARCH (and failing fast for unsupported arches) or otherwise documenting/enforcing amd64-only builds.

Suggested change
# Install wkhtmltopdf from binary (not available via apt on Debian Trixie)
RUN curl -fsSL https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6.1-3/wkhtmltox_0.12.6.1-3.bookworm_amd64.deb -o /tmp/wkhtmltox.deb && \
ARG TARGETARCH
# Install wkhtmltopdf from binary (not available via apt on Debian Trixie)
RUN case "${TARGETARCH}" in \
amd64) wkhtmltox_arch=amd64 ;; \
arm64) wkhtmltox_arch=arm64 ;; \
*) echo "Unsupported TARGETARCH for wkhtmltopdf: ${TARGETARCH}" >&2; exit 1 ;; \
esac && \
curl -fsSL "https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6.1-3/wkhtmltox_0.12.6.1-3.bookworm_${wkhtmltox_arch}.deb" -o /tmp/wkhtmltox.deb && \

Copilot uses AI. Check for mistakes.
apt-get update -qq && \
apt-get install --no-install-recommends -y /tmp/wkhtmltox.deb && \
rm -rf /tmp/wkhtmltox.deb /var/lib/apt/lists /var/cache/apt/archives
Comment on lines 18 to +26
Copy link

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The base stage now runs apt-get update twice in separate layers (once for base packages, again for wkhtmltopdf). To reduce build time and layer count, consider combining the wkhtmltopdf install into the existing base-packages RUN step (keeping a single apt-get update and a single cleanup).

Copilot uses AI. Check for mistakes.

# Set production environment
ENV RAILS_ENV="production" \
BUNDLE_DEPLOYMENT="1" \
Expand Down
Loading