Docker document conversion

Choose a profile

Every Compose service is opt-in and uses the same GordonKit image. Use cli for local commands, standalone-lo for the API with included LibreOffice, or gateway-gotenberg for the API backed by a separate renderer.

CLI profile

CLI mode uses included LibreOffice, mounts the current directory at /work, and does not require an API key. The same one-line command works in Bash and PowerShell.

docker compose -f docker/compose.yaml --profile cli run --rm --build cli convert /work/report.docx --output /work/report.pdf --engine libreoffice --overwrite

Standalone LibreOffice API

Run the authenticated API and LibreOffice in one container when simple deployment and local rendering matter more than independent renderer scaling.

# .env
GORDON_DOC_API_KEY=replace-me

docker compose -f docker/compose.yaml --env-file .env --profile standalone-lo up --build

Gotenberg gateway

Run the API with a separate Gotenberg service when renderer isolation and independent service health are preferred. Compose connects both services to the gordon-doc network and waits for Gotenberg to become healthy. Configuring the Gotenberg URL explicitly selects that engine; failures do not silently fall back to LibreOffice.

docker compose -f docker/compose.yaml --env-file .env --profile gateway-gotenberg up --build

Bash API request

Load the deployer-managed key from .env, then select the engine explicitly and save the PDF response.

set -a; . ./.env; set +a
curl --fail-with-body -H "Authorization: Bearer $GORDON_DOC_API_KEY" -H "Content-Type: application/vnd.openxmlformats-officedocument.wordprocessingml.document" -H "X-Filename: report.docx" --data-binary @report.docx "http://127.0.0.1:8000/conversions?engine=gotenberg" --output report-gb.pdf

PowerShell API request

PowerShell can read the same .env file and save the binary response with Invoke-WebRequest. Use engine=libreoffice with the standalone profile.

$env:GORDON_DOC_API_KEY = ((Get-Content .env | Where-Object { $_ -match '^GORDON_DOC_API_KEY=' }) -replace '^GORDON_DOC_API_KEY=', '')
$headers = @{ Authorization = "Bearer $env:GORDON_DOC_API_KEY"; 'X-Filename' = 'report.docx' }
Invoke-WebRequest -Uri 'http://127.0.0.1:8000/conversions?engine=gotenberg' -Method Post -Headers $headers -ContentType 'application/vnd.openxmlformats-officedocument.wordprocessingml.document' -InFile .\report.docx -OutFile .\report-gb.pdf

Stop the services

Stop the profile after local testing. The generated PDF remains on the host.

docker compose -f docker/compose.yaml --profile standalone-lo down
docker compose -f docker/compose.yaml --profile gateway-gotenberg down

Published image

Tagged releases publish one linux/amd64 image at gordonkit/gordon-doc-converter. The default entrypoint runs the CLI; pass api to start the HTTP service. Prefer an explicit version tag for reproducible deployments.

docker run --rm gordonkit/gordon-doc-converter:0.6.0 version
docker run --rm -p 8000:8000 -e GORDON_DOC_API_KEY=replace-me gordonkit/gordon-doc-converter:0.6.0 api

Operations and security

All profiles run as a non-root user with a read-only root filesystem, a bounded temporary filesystem, and no-new-privileges. API profiles require a strong key; production ingress must also enforce request-size and distributed rate limits.

python docker/smoke.py --token replace-me --docx sample.docx