Run it in a container

complydoc comes as a container image that audits a folder of documents and serves the viewer on the reports. It is how complydoc runs where nothing is installed by hand: a server your team shares, or a job in your own infrastructure. Nothing in the image reaches the network when it runs, unless you give it a bucket for the reports.

Get the image

Each release publishes it:

docker pull ghcr.io/complydoc/complydoc

That image reads documents, with OCR for scanned pages, and serves the viewer. A second one adds a name model, so person and organisation names are found:

docker pull ghcr.io/complydoc/complydoc:names

The name model is the small English one, and it is inside the image, so a run downloads nothing. Name detection models says what it finds and what it misses.

latest and names follow the newest release. To stay on one, name it: ghcr.io/complydoc/complydoc:0.7.4, or :0.7.4-names. Both are built for Intel and Arm machines, and each carries signed build provenance.

The commands below call the image complydoc. Give the one you pulled that name, or write its full name in its place:

docker tag ghcr.io/complydoc/complydoc complydoc

Or build it yourself

From a checkout of the repository, which is also how to try a change before it is released:

git clone https://github.com/complydoc/complydoc
cd complydoc
docker build -t complydoc .
docker build -t complydoc:names --target names .

Audit a folder

Give it the documents to read and a folder to write the reports in:

docker run --rm \
  -v "$PWD/documents:/documents:ro" \
  -v "$PWD/reports:/reports" \
  complydoc audit /documents --out /reports

The documents are mounted read-only: an audit never changes them. Everything after the image’s name is a complydoc command, so check, diff and the rest run the same way.

The image runs as its own user, not as root. If the reports folder is yours and that user cannot write to it, run it as you:

docker run --rm --user "$(id -u):$(id -g)" \
  -v "$PWD/documents:/documents:ro" \
  -v "$PWD/reports:/reports" \
  complydoc audit /documents --out /reports

To be sure nothing leaves the machine, take the network away. An audit does not need one:

docker run --rm --network none \
  -v "$PWD/documents:/documents:ro" \
  -v "$PWD/reports:/reports" \
  complydoc audit /documents --out /reports

Serve the viewer to a team

Run with no command, the image serves the viewer on /reports:

docker run -d --name complydoc -p 8500:8500 \
  -v "$PWD/reports:/reports:ro" \
  complydoc

Open http://localhost:8500/ on that machine, or its name from another one. Everyone who can reach port 8500 on it opens the same reports, and a report written into the folder appears when the page is reloaded. Served this way the viewer is read-only: it has no sign-in of its own, so it changes no file, and the reports can be mounted read-only as above.

Run it for your team has a Compose file that does this with a sign-in proxy in front. To do it by hand, put it behind the proxy that already signs your people in and serves HTTPS, and tell it the name the proxy serves it under:

docker run -d --name complydoc -p 8500:8500 \
  -v "$PWD/reports:/reports:ro" \
  complydoc ui /reports --host 0.0.0.0 --allowed-host reports.example.com

Reports in a bucket

Both images can write reports to a bucket and serve them from one, in place of a mounted folder. Give them the address and the credentials your bucket needs:

docker run --rm \
  -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_DEFAULT_REGION \
  -v "$PWD/documents:/documents:ro" \
  complydoc audit /documents --out s3://team-reports/contracts --name "audit-$(date +%Y%m%d-%H%M%S)"

docker run -d -p 8500:8500 \
  -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_DEFAULT_REGION \
  complydoc ui s3://team-reports/contracts --host 0.0.0.0

AWS_ENDPOINT_URL names another S3-compatible store. This is the one case where a run reaches a network, and it reaches only that bucket: Run it for your team has the details.

What is in the image

	complydoc	complydoc:names
Audits, checks, the viewer	yes	yes
OCR for scanned pages	yes	yes
Person and organisation names	no, and the report says so	yes, English
Runs as	its own user	its own user
Reaches the network	only a bucket you name	only a bucket you name