Docling Permission Denied on Model Download in Docker with Non-Root User

[Mirooww]

I'm running Docling in a Docker container with a non-root user. When DocumentConverter tries to initialize, it fails with a permission error while attempting to download OCR models:

[Errno 13] Permission denied: '/usr/local/lib/python3.12/site-packages/rapidocr/models/ch_PP-OCRv4_det_infer.pth'

The models still attempt to download at runtime when the non-root user calls DocumentConverter(), causing permission errors.

[dosubot]

Hi @Mirooww! I'm Dosu and I’m helping the docling team.

This happens because Docling (via DocumentConverter and RapidOCR) tries to download OCR models at runtime into the Python package directory (like /usr/local/lib/python3.12/site-packages/rapidocr/models/), which is not writable by non-root users in Docker. Even if you pre-download models, Docling will still attempt to write to this location unless you explicitly configure the model path, causing permission errors [source].

To fix this, pre-download the models into a directory writable by your non-root user (for example, /app/models), and set the environment variable DOCLING_ARTIFACTS_PATH (or DOCLING_SERVE_ARTIFACTS_PATH if using docling-serve) to point to that directory. This ensures both Docling and RapidOCR use the same cache and avoid runtime downloads and permission errors [source].

Example workflow:

1. On your host, run:

   docling-tools models download --all -o /path/to/models
   

2. In your Dockerfile or docker-compose, mount /path/to/models into the container (e.g., /app/models), and set:

   ENV DOCLING_ARTIFACTS_PATH=/app/models
   

3. Make sure the non-root user in the container has read/write access to /app/models.

If you use Kubernetes or OpenShift, mount a PersistentVolumeClaim at the desired path and set the environment variable accordingly [source].

This setup prevents permission errors and ensures Docling loads models from a writable location, avoiding runtime downloads and failures.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[Mirooww]

@dosu it is not possible to install models directly with the dockerfile ??
Because downloading every file in local, then in the docker container is kinda annoying

[dosubot]

Yes, you can install models directly in your Dockerfile—no need to download them locally first. Just add a line like RUN docling-tools models download smolvlm easyocr to your Dockerfile after the base image. Here’s a minimal example:

FROM quay.io/docling-project/docling-serve
RUN docling-tools models download smolvlm easyocr
ENV DOCLING_SERVE_ARTIFACTS_PATH=/opt/app-root/src/models

Make sure the directory you use for models (here, /opt/app-root/src/models) is writable by your non-root user at runtime. You can adjust the path and permissions as needed. This approach ensures all models are present in the image and avoids runtime downloads or permission errors see official docs.

Alternative approaches: you can also override the entrypoint to download models at container startup, or mount a volume with pre-downloaded models and set DOCLING_SERVE_ARTIFACTS_PATH to that path, but the Dockerfile method is usually the simplest for most workflows.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}