"ocrmypdf: not found" using Snap (on Ubuntu)

[oraculix]

Hi folks,
I installed by the Readme and I'm able to run ocrmypdf manually in my filesystem.
However, my NC setup uses S3 (in this case: Oracle Object Storage) as the primary storage. Maybe this causes the following behaviour:

{"reqId":"F61yl5oNvBn1cdL9YyzC","level":2,"time":"2022-01-06T13:34:09+00:00","remoteAddr":"","user":"dummy","app":"workflow_ocr","method":"","url":"--","message":"OCRmyPDF succeeded with warning(s): sh: 1: ocrmypdf: not found, ","userAgent":"--","version":"22.2.3.0"}
{"reqId":"F61yl5oNvBn1cdL9YyzC","level":3,"time":"2022-01-06T13:34:09+00:00","remoteAddr":"","user":"dummy","app":"workflow_ocr","method":"","url":"--","message":"OCR for file /dummy/files/Documents/xxx/2021/yyy.pdf not possible. Message: OCRmyPDF did not produce any output","userAgent":"--","version":"22.2.3.0"}

OS : Ubuntu 20.04, x64
NC : 22.2.3, installed via snap
Workflow OCR : 1.22.4
OCRmyPDF : 9.6.0+dfsg

Thanks for putting your time into this App, it looks promising!
Uwe

[R0Wi]

Hi Uwe,

thanks for your detailled description. For me it looks like the process which is executing your NC cron (which in term executes the OCR processing) does not know the ocrmypdf command on your system. This could have multiple reasons, depending on your system setup. I don't think that it has anything to do with the kind of storage you're using.

So from my point of view there are a few things you could check:

• How is your cron processing setup? Ajax, Cron, ...?
• Which user runs the NC cron?
• Does the command ocrmypdf --version work if you login to your machines console and run it as the user which runs the NC cron?
• Does the OCR processing work on other files stored locally (so NOT on your S3 storage)?

Depending on your NC cron setup you could simluate the behaviour of the app by creating a PHP script with the following content:

<?php
echo exec('ocrmypdf --version');

and either run it directly through the CLI (if you're using NC cron triggered by Linux crontab) or by browsing to the appropriate URL (if you're using Ajax).

Please let me know your results 👍

[oraculix]

Hi Robin,
I can do further tests in 2 or 3 days.
Short info for the time being:
NC was installed with 'snap' using sudo. So I suppose it runs in the root context (and I'm not quite fond of that).
Ocrmypdf worked from root with pdf's in local storage.
So far for now, more to come.

[oraculix]

Hi Robin,
concerning your questions:

• How is your cron processing setup? Ajax, Cron, ...?

It uses cron, which is the default setting of the snap image.

• Which user runs the NC cron?

This must be root (the snap must be installed with sudo). But in root's crontab there is no entry. So I suppose this is "hidden" somewhere within the snap subdirectory, but I couldn't find any information about it so far.

• Does the command ocrmypdf --version work if you login to your machines console and run it as the user which runs the NC cron?

Yes, it runs when called as root (and also with other users).

• Does the OCR processing work on other files stored locally (so NOT on your S3 storage)?

Yes, it does. I tested this with a PDF in the local filesystem. Furthermore, I deployed another NC instance with a filesystem as primary storage and had the same issue. I'm beginning to suspect the snap environment as the cause, although my (admittedly basic) understanding of snap is that it is not as restrictive as Docker containers, meaning that binaries from the "host" OS can be called from inside the snap environment.

Depending on your NC cron setup you could simluate the behaviour of the app by creating a PHP script with the following content:

Sorry, I couldn't find a way how to do this in a snap environment. Calling the php binary inside of it just throws a bunch of errors at me.

As a side question: are you still planning a functionality to use a dockerized ocrmypdf? Not only for security reasons I would prefer Docker over snap, anyway.

Cheers,
Uwe

[R0Wi]

Hi Uwe and thanks for your detailled information.

I'm beginning to suspect the snap environment as the cause, although my (admittedly basic) understanding of snap is that it is not as restrictive as Docker containers, meaning that binaries from the "host" OS can be called from inside the snap environment.

So currently i also suspect the snap environment to be the culprit here. To be honest i'm not working with snap and i neither have a deeper knowledge of the technology. But when looking at the official snap package file of Nextcloud (https://github.com/nextcloud-snap/nextcloud-snap/blob/3cc30c6f501d10a99114913696d79110961fc84d/snap/snapcraft.yaml) it seems like it's only packed with apache, php, mysql and a few other binaries. So if these are the only programs you can call inside that snap it's quite clear that ocrmypdf is missing in that environment. Since i'm quite uncertain about that i'm going to call @bahnwaerter these days and ask him for advice. We're going to report our results here so stay tuned 😃

[oraculix]

Well then, thanks so far. Looking forward to hearing from you soon.
Grüßle ins Ländle! :-)

[R0Wi]

Hi Uwe @bahnwaerter and i just wanted to give you some short feedback regarding issues with this app when used inside the official NC snap. Unfortunately we did't find any nice solution for your problem: it seems like binaries from the host system cannot just be used inside of a snap because of its sandbox behaviour. So in your case the NC OCR-app, which is running inside a snap, cannot see or use the ocrmypdf binary installed on the host system.

If you search the internet you'll find some workarounds but they are not meant to be used inside a production system (see https://forum.snapcraft.io/t/how-to-execute-programs-outside-of-snap-package/11755 for example).

So for us the only production ready solution would be to build your own NC snap with ocrmypdf bundled into it. The links https://askubuntu.com/questions/1052814/how-to-add-a-shell-script-as-a-command-offered-by-a-snap/1056970#1056970 and https://ubuntu.com/tutorials/create-your-first-snap#1-overview could help you getting there. Unfortunately this would lead to a lot of manual maintenance work and we can image that this isn't an appropriate solution for you, even though it would be possible.

Back to your docker question: yes we are working on a solution where we provide the OCR backend inside a standalone docker-container which can be used via network (most likely it will be http). This could be interesting for you because usually you should be able to connect to a service listening on the host inside of a snap. But there is still much work to do so you might be interested in tracking our progress at #51.

Sorry that we can't provide a nicer solution here. Would it be ok for you to close this issue and maybe rename it so that it's clear that the problem you described is most likely related to NC snap? Please feel free to ask if we help you further.

PS: Grüßle zurück ;-)

[oraculix]

Hi Robin,
thank you for the extensive answer. As snap seems to be the second best option compared to Docker containers, I'd rather wait for your implementation of #51. In the meantime I'll stick to OCR'ing separately using the official OCRmyPDF container as described here.

Cheers,
Uwe