feat(libreoffice): block linked content from untrusted locations

Bumps [github.com/shirou/gopsutil/v4](https://github.com/shirou/gopsutil) from 4.26.4 to 4.26.5.
- [Release notes](https://github.com/shirou/gopsutil/releases)
- [Commits](https://github.com/shirou/gopsutil/compare/v4.26.4...v4.26.5)

---
updated-dependencies:
- dependency-name: github.com/shirou/gopsutil/v4
  dependency-version: 4.26.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.bruno/Chromium/Convert/HTML to PDF.bru

@@ -0,0 +1,86 @@
+meta {
+  name: HTML to PDF
+  type: http
+  seq: 2
+}
+
+post {
+  url: {{baseUrl}}/forms/chromium/convert/html
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../test/integration/testdata/page-1-html/index.html)
+  ~landscape: false
+  ~printBackground: false
+  ~scale: 1.0
+  ~singlePage: false
+  ~paperWidth: 8.5
+  ~paperHeight: 11
+  ~marginTop: 0.39
+  ~marginBottom: 0.39
+  ~marginLeft: 0.39
+  ~marginRight: 0.39
+  ~nativePageRanges: 1-2
+  ~preferCssPageSize: false
+  ~generateDocumentOutline: false
+  ~generateTaggedPdf: false
+  ~skipNetworkIdleEvent: false
+  ~failOnHttpStatusCodes: [499,599]
+  ~failOnResourceHttpStatusCodes: []
+  ~ignoreResourceHttpStatusDomains: []
+  ~failOnResourceLoadingFailed: false
+  ~failOnConsoleExceptions: false
+  ~waitDelay: 0s
+  ~waitWindowStatus:
+  ~waitForExpression:
+  ~waitForSelector:
+  ~cookies: [{"name":"my_cookie","value":"my_value","domain":"example.com"}]
+  ~userAgent:
+  ~extraHttpHeaders: {"X-Custom-Header":"value"}
+  ~emulatedMediaType: print
+  ~emulatedMediaFeatures: {"prefers-color-scheme":"dark"}
+  ~omitBackground: false
+  ~splitMode: intervals
+  ~splitSpan: 1
+  ~splitUnify: false
+  ~pdfa: PDF/A-1b
+  ~pdfua: true
+  ~metadata: {"Author":"Bruno","Title":"Test"}
+  ~userPassword:
+  ~ownerPassword:
+  ~allowPrinting: false
+  ~allowCopying: false
+  ~allowModifying: false
+  ~allowAnnotating: false
+  ~allowFillingForms: false
+  ~allowAssembling: false
+  ~embeds: @file(../test/integration/testdata/embed_1.xml)
+  ~embeds: @file(../test/integration/testdata/embed_2.xml)
+  ~embedsMetadata: {"embed_1.xml":{"mimeType":"text/xml","relationship":"Data"}, "embed_2.xml":{"mimeType":"text/xml","relationship":"Data"}}
+  ~facturxXml: @file(../test/integration/testdata/embed_1.xml)
+  ~facturxConformanceLevel: EN 16931
+  ~facturxDocumentType: INVOICE
+  ~facturxVersion: 1.0
+  ~watermarkSource: text
+  ~watermarkExpression: CONFIDENTIAL
+  ~watermarkPages:
+  ~watermarkOptions: {"scale":"0.5 abs","rot":"45","fillcolor":"#FF0000"}
+  ~stampSource: text
+  ~stampExpression: DRAFT
+  ~stampPages:
+  ~stampOptions: {"scale":"0.5 abs","rot":"45"}
+  ~rotateAngle: 90
+  ~rotatePages:
+}
+
+headers {
+  ~Gotenberg-Output-Filename: my-file
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/Chromium/Convert/Markdown to PDF.bru

@@ -0,0 +1,87 @@
+meta {
+  name: Markdown to PDF
+  type: http
+  seq: 3
+}
+
+post {
+  url: {{baseUrl}}/forms/chromium/convert/markdown
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../../test/integration/testdata/page-1-markdown/index.html)
+  files: @file(../../test/integration/testdata/page-1-markdown/page_1.md)
+  ~landscape: false
+  ~printBackground: false
+  ~scale: 1.0
+  ~singlePage: false
+  ~paperWidth: 8.5
+  ~paperHeight: 11
+  ~marginTop: 0.39
+  ~marginBottom: 0.39
+  ~marginLeft: 0.39
+  ~marginRight: 0.39
+  ~nativePageRanges: 1-2
+  ~preferCssPageSize: false
+  ~generateDocumentOutline: false
+  ~generateTaggedPdf: false
+  ~skipNetworkIdleEvent: false
+  ~failOnHttpStatusCodes: [499,599]
+  ~failOnResourceHttpStatusCodes: []
+  ~ignoreResourceHttpStatusDomains: []
+  ~failOnResourceLoadingFailed: false
+  ~failOnConsoleExceptions: false
+  ~waitDelay: 0s
+  ~waitWindowStatus:
+  ~waitForExpression:
+  ~waitForSelector:
+  ~cookies: [{"name":"my_cookie","value":"my_value","domain":"example.com"}]
+  ~userAgent:
+  ~extraHttpHeaders: {"X-Custom-Header":"value"}
+  ~emulatedMediaType: print
+  ~emulatedMediaFeatures: {"prefers-color-scheme":"dark"}
+  ~omitBackground: false
+  ~splitMode: intervals
+  ~splitSpan: 1
+  ~splitUnify: false
+  ~pdfa: PDF/A-1b
+  ~pdfua: true
+  ~metadata: {"Author":"Bruno","Title":"Test"}
+  ~userPassword:
+  ~ownerPassword:
+  ~allowPrinting: false
+  ~allowCopying: false
+  ~allowModifying: false
+  ~allowAnnotating: false
+  ~allowFillingForms: false
+  ~allowAssembling: false
+  ~embeds: @file(../test/integration/testdata/embed_1.xml)
+  ~embeds: @file(../test/integration/testdata/embed_2.xml)
+  ~embedsMetadata: {"embed_1.xml":{"mimeType":"text/xml","relationship":"Data"}, "embed_2.xml":{"mimeType":"text/xml","relationship":"Data"}}
+  ~facturxXml: @file(../../test/integration/testdata/embed_1.xml)
+  ~facturxConformanceLevel: EN 16931
+  ~facturxDocumentType: INVOICE
+  ~facturxVersion: 1.0
+  ~watermarkSource: text
+  ~watermarkExpression: CONFIDENTIAL
+  ~watermarkPages:
+  ~watermarkOptions: {"scale":"0.5 abs","rot":"45","fillcolor":"#FF0000"}
+  ~stampSource: text
+  ~stampExpression: DRAFT
+  ~stampPages:
+  ~stampOptions: {"scale":"0.5 abs","rot":"45"}
+  ~rotateAngle: 90
+  ~rotatePages:
+}
+
+headers {
+  ~Gotenberg-Output-Filename: my-file
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/Chromium/Convert/URL to PDF.bru

@@ -0,0 +1,86 @@
+meta {
+  name: URL to PDF
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{baseUrl}}/forms/chromium/convert/url
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  url: https://example.com
+  ~landscape: false
+  ~printBackground: false
+  ~scale: 1.0
+  ~singlePage: false
+  ~paperWidth: 8.5
+  ~paperHeight: 11
+  ~marginTop: 0.39
+  ~marginBottom: 0.39
+  ~marginLeft: 0.39
+  ~marginRight: 0.39
+  ~nativePageRanges: 1-2
+  ~preferCssPageSize: false
+  ~generateDocumentOutline: false
+  ~generateTaggedPdf: false
+  ~skipNetworkIdleEvent: false
+  ~failOnHttpStatusCodes: [499,599]
+  ~failOnResourceHttpStatusCodes: []
+  ~ignoreResourceHttpStatusDomains: []
+  ~failOnResourceLoadingFailed: false
+  ~failOnConsoleExceptions: false
+  ~waitDelay: 0s
+  ~waitWindowStatus:
+  ~waitForExpression:
+  ~waitForSelector:
+  ~cookies: [{"name":"my_cookie","value":"my_value","domain":"example.com"}]
+  ~userAgent:
+  ~extraHttpHeaders: {"X-Custom-Header":"value"}
+  ~emulatedMediaType: print
+  ~emulatedMediaFeatures: {"prefers-color-scheme":"dark"}
+  ~omitBackground: false
+  ~splitMode: intervals
+  ~splitSpan: 1
+  ~splitUnify: false
+  ~pdfa: PDF/A-1b
+  ~pdfua: true
+  ~metadata: {"Author":"Bruno","Title":"Test"}
+  ~userPassword:
+  ~ownerPassword:
+  ~allowPrinting: false
+  ~allowCopying: false
+  ~allowModifying: false
+  ~allowAnnotating: false
+  ~allowFillingForms: false
+  ~allowAssembling: false
+  ~embeds: @file(../test/integration/testdata/embed_1.xml)
+  ~embeds: @file(../test/integration/testdata/embed_2.xml)
+  ~embedsMetadata: {"embed_1.xml":{"mimeType":"text/xml","relationship":"Data"}, "embed_2.xml":{"mimeType":"text/xml","relationship":"Data"}}
+  ~facturxXml: @file(../test/integration/testdata/embed_1.xml)
+  ~facturxConformanceLevel: EN 16931
+  ~facturxDocumentType: INVOICE
+  ~facturxVersion: 1.0
+  ~watermarkSource: text
+  ~watermarkExpression: CONFIDENTIAL
+  ~watermarkPages:
+  ~watermarkOptions: {"scale":"0.5 abs","rot":"45","fillcolor":"#FF0000"}
+  ~stampSource: text
+  ~stampExpression: DRAFT
+  ~stampPages:
+  ~stampOptions: {"scale":"0.5 abs","rot":"45"}
+  ~rotateAngle: 90
+  ~rotatePages:
+}
+
+headers {
+  ~Gotenberg-Output-Filename: my-file
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/Chromium/Screenshot/HTML Screenshot.bru

@@ -0,0 +1,48 @@
+meta {
+  name: HTML Screenshot
+  type: http
+  seq: 2
+}
+
+post {
+  url: {{baseUrl}}/forms/chromium/screenshot/html
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../../test/integration/testdata/page-1-html/index.html)
+  ~width: 800
+  ~height: 600
+  ~clip: false
+  ~format: png
+  ~quality: 100
+  ~optimizeForSpeed: false
+  ~skipNetworkIdleEvent: false
+  ~failOnHttpStatusCodes: [499,599]
+  ~failOnResourceHttpStatusCodes: []
+  ~ignoreResourceHttpStatusDomains: []
+  ~failOnResourceLoadingFailed: false
+  ~failOnConsoleExceptions: false
+  ~waitDelay: 0s
+  ~waitWindowStatus:
+  ~waitForExpression:
+  ~waitForSelector:
+  ~cookies: [{"name":"my_cookie","value":"my_value","domain":"example.com"}]
+  ~userAgent:
+  ~extraHttpHeaders: {"X-Custom-Header":"value"}
+  ~emulatedMediaType: screen
+  ~emulatedMediaFeatures: {"prefers-color-scheme":"dark"}
+  ~omitBackground: false
+  ~deviceScaleFactor: 1.0
+}
+
+headers {
+  ~Gotenberg-Output-Filename: my-screenshot
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/Chromium/Screenshot/Markdown Screenshot.bru

@@ -0,0 +1,49 @@
+meta {
+  name: Markdown Screenshot
+  type: http
+  seq: 3
+}
+
+post {
+  url: {{baseUrl}}/forms/chromium/screenshot/markdown
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../../test/integration/testdata/page-1-markdown/index.html)
+  files: @file(../../test/integration/testdata/page-1-markdown/page_1.md)
+  ~width: 800
+  ~height: 600
+  ~clip: false
+  ~format: png
+  ~quality: 100
+  ~optimizeForSpeed: false
+  ~skipNetworkIdleEvent: false
+  ~failOnHttpStatusCodes: [499,599]
+  ~failOnResourceHttpStatusCodes: []
+  ~ignoreResourceHttpStatusDomains: []
+  ~failOnResourceLoadingFailed: false
+  ~failOnConsoleExceptions: false
+  ~waitDelay: 0s
+  ~waitWindowStatus:
+  ~waitForExpression:
+  ~waitForSelector:
+  ~cookies: [{"name":"my_cookie","value":"my_value","domain":"example.com"}]
+  ~userAgent:
+  ~extraHttpHeaders: {"X-Custom-Header":"value"}
+  ~emulatedMediaType: screen
+  ~emulatedMediaFeatures: {"prefers-color-scheme":"dark"}
+  ~omitBackground: false
+  ~deviceScaleFactor: 1.0
+}
+
+headers {
+  ~Gotenberg-Output-Filename: my-screenshot
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/Chromium/Screenshot/URL Screenshot.bru

@@ -0,0 +1,48 @@
+meta {
+  name: URL Screenshot
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{baseUrl}}/forms/chromium/screenshot/url
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  url: https://example.com
+  ~width: 800
+  ~height: 600
+  ~clip: false
+  ~format: png
+  ~quality: 100
+  ~optimizeForSpeed: false
+  ~skipNetworkIdleEvent: false
+  ~failOnHttpStatusCodes: [499,599]
+  ~failOnResourceHttpStatusCodes: []
+  ~ignoreResourceHttpStatusDomains: []
+  ~failOnResourceLoadingFailed: false
+  ~failOnConsoleExceptions: false
+  ~waitDelay: 0s
+  ~waitWindowStatus:
+  ~waitForExpression:
+  ~waitForSelector:
+  ~cookies: [{"name":"my_cookie","value":"my_value","domain":"example.com"}]
+  ~userAgent:
+  ~extraHttpHeaders: {"X-Custom-Header":"value"}
+  ~emulatedMediaType: screen
+  ~emulatedMediaFeatures: {"prefers-color-scheme":"dark"}
+  ~omitBackground: false
+  ~deviceScaleFactor: 1.0
+}
+
+headers {
+  ~Gotenberg-Output-Filename: my-screenshot
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/Health & Info/Debug.bru

@@ -0,0 +1,11 @@
+meta {
+  name: Debug
+  type: http
+  seq: 3
+}
+
+get {
+  url: {{baseUrl}}/debug
+  body: none
+  auth: none
+}

.bruno/Health & Info/Health.bru

@@ -0,0 +1,11 @@
+meta {
+  name: Health
+  type: http
+  seq: 1
+}
+
+get {
+  url: {{baseUrl}}/health
+  body: none
+  auth: none
+}

.bruno/Health & Info/Prometheus Metrics.bru

@@ -0,0 +1,11 @@
+meta {
+  name: Prometheus Metrics
+  type: http
+  seq: 4
+}
+
+get {
+  url: {{baseUrl}}/prometheus/metrics
+  body: none
+  auth: none
+}

.bruno/Health & Info/Version.bru

@@ -0,0 +1,11 @@
+meta {
+  name: Version
+  type: http
+  seq: 2
+}
+
+get {
+  url: {{baseUrl}}/version
+  body: none
+  auth: none
+}

.bruno/LibreOffice/Convert to PDF.bru

@@ -0,0 +1,103 @@
+meta {
+  name: Convert to PDF
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{baseUrl}}/forms/libreoffice/convert
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../test/integration/testdata/page_1.docx)
+  ~password:
+  ~landscape: false
+  ~nativePageRanges:
+  ~updateIndexes: false
+  ~exportFormFields: true
+  ~allowDuplicateFieldNames: false
+  ~exportBookmarks: true
+  ~exportBookmarksToPdfDestination: false
+  ~exportPlaceholders: false
+  ~exportNotes: false
+  ~exportNotesPages: false
+  ~exportOnlyNotesPages: false
+  ~exportNotesInMargin: false
+  ~convertOooTargetToPdfTarget: false
+  ~exportLinksRelativeFsys: false
+  ~exportHiddenSlides: false
+  ~skipEmptyPages: false
+  ~addOriginalDocumentAsStream: false
+  ~singlePageSheets: false
+  ~initialView: 0
+  ~initialPage: 1
+  ~magnification: 0
+  ~zoom: 100
+  ~pageLayout: 0
+  ~firstPageOnLeft: false
+  ~resizeWindowToInitialPage: false
+  ~centerWindow: false
+  ~openInFullScreenMode: false
+  ~displayPDFDocumentTitle: true
+  ~hideViewerMenubar: false
+  ~hideViewerToolbar: false
+  ~hideViewerWindowControls: false
+  ~useTransitionEffects: true
+  ~openBookmarkLevels: -1
+  ~losslessImageCompression: false
+  ~quality: 90
+  ~reduceImageResolution: false
+  ~maxImageResolution: 300
+  ~nativeWatermarkText:
+  ~nativeWatermarkColor: 0
+  ~nativeWatermarkFontHeight: 0
+  ~nativeWatermarkRotateAngle: 0
+  ~nativeWatermarkFontName:
+  ~nativeTiledWatermarkText:
+  ~nativePdfFormats: true
+  ~merge: false
+  ~flatten: false
+  ~splitMode: intervals
+  ~splitSpan: 1
+  ~splitUnify: false
+  ~pdfa: PDF/A-1b
+  ~pdfua: true
+  ~metadata: {"Author":"Bruno","Title":"Test"}
+  ~userPassword:
+  ~ownerPassword:
+  ~allowPrinting: false
+  ~allowCopying: false
+  ~allowModifying: false
+  ~allowAnnotating: false
+  ~allowFillingForms: false
+  ~allowAssembling: false
+  ~embeds: @file(../test/integration/testdata/embed_1.xml)
+  ~embeds: @file(../test/integration/testdata/embed_2.xml)
+  ~embedsMetadata: {"embed_1.xml":{"mimeType":"text/xml","relationship":"Data"}, "embed_2.xml":{"mimeType":"text/xml","relationship":"Data"}}
+  ~facturxXml: @file(../test/integration/testdata/embed_1.xml)
+  ~facturxConformanceLevel: EN 16931
+  ~facturxDocumentType: INVOICE
+  ~facturxVersion: 1.0
+  ~watermarkSource: text
+  ~watermarkExpression: CONFIDENTIAL
+  ~watermarkPages:
+  ~watermarkOptions: {"scale":"0.5 abs","rot":"45","fillcolor":"#FF0000"}
+  ~stampSource: text
+  ~stampExpression: DRAFT
+  ~stampPages:
+  ~stampOptions: {"scale":"0.5 abs","rot":"45"}
+  ~rotateAngle: 90
+  ~rotatePages:
+}
+
+headers {
+  ~Gotenberg-Output-Filename: my-file
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/PDF Engines/Bookmarks/Read Bookmarks.bru

@@ -0,0 +1,24 @@
+meta {
+  name: Read Bookmarks
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{baseUrl}}/forms/pdfengines/bookmarks/read
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../../test/integration/testdata/page_1.pdf)
+}
+
+headers {
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/PDF Engines/Bookmarks/Write Bookmarks.bru

@@ -0,0 +1,26 @@
+meta {
+  name: Write Bookmarks
+  type: http
+  seq: 2
+}
+
+post {
+  url: {{baseUrl}}/forms/pdfengines/bookmarks/write
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../../test/integration/testdata/page_1.pdf)
+  bookmarks: [{"title":"Chapter 1","page":1,"children":[{"title":"Section 1.1","page":1}]}]
+}
+
+headers {
+  ~Gotenberg-Output-Filename: with-bookmarks
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/PDF Engines/Convert/Convert PDF.bru

@@ -0,0 +1,27 @@
+meta {
+  name: Convert PDF
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{baseUrl}}/forms/pdfengines/convert
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../../test/integration/testdata/page_1.pdf)
+  pdfa: PDF/A-1b
+  ~pdfua: true
+}
+
+headers {
+  ~Gotenberg-Output-Filename: converted
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/PDF Engines/Embed/Embed Files.bru

@@ -0,0 +1,33 @@
+meta {
+  name: Embed Files
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{baseUrl}}/forms/pdfengines/embed
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../test/integration/testdata/page_1.pdf)
+  embeds: @file(../test/integration/testdata/embed_1.xml)
+  embeds: @file(../test/integration/testdata/embed_2.xml)
+  embedsMetadata: {"embed_1.xml":{"mimeType":"text/xml","relationship":"Data"}, "embed_2.xml":{"mimeType":"text/xml","relationship":"Data"}}
+  ~facturxXml: @file(../test/integration/testdata/embed_1.xml)
+  ~facturxConformanceLevel: EN 16931
+  ~facturxDocumentType: INVOICE
+  ~facturxVersion: 1.0
+  ~downloadFrom: [{"url":"https://example.com/attachment.xml","embedded":true}]
+}
+
+headers {
+  ~Gotenberg-Output-Filename: with-embeds
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/PDF Engines/Encrypt/Encrypt PDF.bru

@@ -0,0 +1,33 @@
+meta {
+  name: Encrypt PDF
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{baseUrl}}/forms/pdfengines/encrypt
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../../test/integration/testdata/page_1.pdf)
+  userPassword: secret123
+  ~ownerPassword: owner456
+  ~allowPrinting: false
+  ~allowCopying: false
+  ~allowModifying: false
+  ~allowAnnotating: false
+  ~allowFillingForms: false
+  ~allowAssembling: false
+}
+
+headers {
+  ~Gotenberg-Output-Filename: encrypted
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/PDF Engines/Factur-X/Inject Factur-X XMP.bru

@@ -0,0 +1,29 @@
+meta {
+  name: Inject Factur-X XMP
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{baseUrl}}/forms/pdfengines/factur-x
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../../test/integration/testdata/page_1.pdf)
+  facturxXml: @file(../../test/integration/testdata/embed_1.xml)
+  facturxConformanceLevel: EN 16931
+  ~facturxDocumentType: INVOICE
+  ~facturxVersion: 1.0
+}
+
+headers {
+  ~Gotenberg-Output-Filename: factur-x
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/PDF Engines/Flatten/Flatten PDF.bru

@@ -0,0 +1,25 @@
+meta {
+  name: Flatten PDF
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{baseUrl}}/forms/pdfengines/flatten
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../../test/integration/testdata/page_1.pdf)
+}
+
+headers {
+  ~Gotenberg-Output-Filename: flattened
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/PDF Engines/Merge/Merge PDFs.bru

@@ -0,0 +1,54 @@
+meta {
+  name: Merge PDFs
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{baseUrl}}/forms/pdfengines/merge
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../../test/integration/testdata/page_1.pdf)
+  files: @file(../../test/integration/testdata/page_2.pdf)
+  ~flatten: false
+  ~autoIndexBookmarks: false
+  ~pdfa: PDF/A-1b
+  ~pdfua: true
+  ~metadata: {"Author":"Bruno","Title":"Test"}
+  ~bookmarks: [{"title":"Page 1","page":1},{"title":"Page 2","page":2}]
+  ~userPassword:
+  ~ownerPassword:
+  ~allowPrinting: false
+  ~allowCopying: false
+  ~allowModifying: false
+  ~allowAnnotating: false
+  ~allowFillingForms: false
+  ~allowAssembling: false
+  ~watermarkSource: text
+  ~watermarkExpression: CONFIDENTIAL
+  ~watermarkPages:
+  ~watermarkOptions: {"scale":"0.5 abs","rot":"45","fillcolor":"#FF0000"}
+  ~stampSource: text
+  ~stampExpression: DRAFT
+  ~stampPages:
+  ~stampOptions: {"scale":"0.5 abs","rot":"45"}
+  ~rotateAngle: 90
+  ~rotatePages:
+  ~facturxXml: @file(../../test/integration/testdata/embed_1.xml)
+  ~facturxConformanceLevel: EN 16931
+  ~facturxDocumentType: INVOICE
+  ~facturxVersion: 1.0
+}
+
+headers {
+  ~Gotenberg-Output-Filename: merged
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/PDF Engines/Metadata/Read Metadata.bru

@@ -0,0 +1,24 @@
+meta {
+  name: Read Metadata
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{baseUrl}}/forms/pdfengines/metadata/read
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../../test/integration/testdata/page_1.pdf)
+}
+
+headers {
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/PDF Engines/Metadata/Write Metadata.bru

@@ -0,0 +1,26 @@
+meta {
+  name: Write Metadata
+  type: http
+  seq: 2
+}
+
+post {
+  url: {{baseUrl}}/forms/pdfengines/metadata/write
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../../test/integration/testdata/page_1.pdf)
+  metadata: {"Author":"Bruno","Copyright":"Bruno","Creator":"Gotenberg","Keywords":["test"],"Marked":true,"Producer":"Gotenberg","Subject":"Test","Title":"Test Document","Trapped":"Unknown"}
+}
+
+headers {
+  ~Gotenberg-Output-Filename: with-metadata
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/PDF Engines/Rotate/Rotate PDF.bru

@@ -0,0 +1,27 @@
+meta {
+  name: Rotate PDF
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{baseUrl}}/forms/pdfengines/rotate
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../../test/integration/testdata/page_1.pdf)
+  rotateAngle: 90
+  ~rotatePages: 1-2
+}
+
+headers {
+  ~Gotenberg-Output-Filename: rotated
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/PDF Engines/Split/Split PDF.bru

@@ -0,0 +1,54 @@
+meta {
+  name: Split PDF
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{baseUrl}}/forms/pdfengines/split
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../../test/integration/testdata/pages_3.pdf)
+  splitMode: intervals
+  splitSpan: 1
+  ~splitUnify: false
+  ~flatten: false
+  ~pdfa: PDF/A-1b
+  ~pdfua: true
+  ~metadata: {"Author":"Bruno","Title":"Test"}
+  ~userPassword:
+  ~ownerPassword:
+  ~allowPrinting: false
+  ~allowCopying: false
+  ~allowModifying: false
+  ~allowAnnotating: false
+  ~allowFillingForms: false
+  ~allowAssembling: false
+  ~watermarkSource: text
+  ~watermarkExpression: CONFIDENTIAL
+  ~watermarkPages:
+  ~watermarkOptions: {"scale":"0.5 abs","rot":"45","fillcolor":"#FF0000"}
+  ~stampSource: text
+  ~stampExpression: DRAFT
+  ~stampPages:
+  ~stampOptions: {"scale":"0.5 abs","rot":"45"}
+  ~rotateAngle: 90
+  ~rotatePages:
+  ~facturxXml: @file(../../test/integration/testdata/embed_1.xml)
+  ~facturxConformanceLevel: EN 16931
+  ~facturxDocumentType: INVOICE
+  ~facturxVersion: 1.0
+}
+
+headers {
+  ~Gotenberg-Output-Filename: split
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/PDF Engines/Stamp/Stamp PDF.bru

@@ -0,0 +1,31 @@
+meta {
+  name: Stamp PDF
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{baseUrl}}/forms/pdfengines/stamp
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../../test/integration/testdata/page_1.pdf)
+  stampSource: text
+  stampExpression: APPROVED
+  ~stampPages: 1-2
+  ~stampOptions: {"font":"Helvetica","fontSize":"48","color":"#00FF00","opacity":"0.5","rotation":"0"}
+  ~stamp: @file(../../test/integration/testdata/watermark.png)
+  ~downloadFrom: [{"url":"https://example.com/stamp.png","field":"stamp"}]
+}
+
+headers {
+  ~Gotenberg-Output-Filename: stamped
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/PDF Engines/Watermark/Watermark PDF.bru

@@ -0,0 +1,31 @@
+meta {
+  name: Watermark PDF
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{baseUrl}}/forms/pdfengines/watermark
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../../test/integration/testdata/page_1.pdf)
+  watermarkSource: text
+  watermarkExpression: CONFIDENTIAL
+  ~watermarkPages: 1-2
+  ~watermarkOptions: {"font":"Helvetica","fontSize":"48","color":"#FF0000","opacity":"0.3","rotation":"45"}
+  ~watermark: @file(../../test/integration/testdata/watermark.png)
+  ~downloadFrom: [{"url":"https://example.com/watermark.png","field":"watermark"}]
+}
+
+headers {
+  ~Gotenberg-Output-Filename: watermarked
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Events-Url: http://localhost:8080/webhook/events
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}

.bruno/README.md

@@ -0,0 +1,65 @@
+# Bruno API Collection
+
+[Bruno](https://www.usebruno.com/) collection mirroring every Gotenberg route. Update the collection when adding or modifying a route.
+
+## Structure
+
+```
+.bruno/
+├── bruno.json                      # Collection config
+├── collection.bru                  # Collection-level defaults (Gotenberg-Trace header)
+├── environments/
+│   ├── Local.bru                   # baseUrl: http://localhost:3000
+│   └── Demo.bru                    # baseUrl: https://demo.gotenberg.dev
+├── Health & Info/                   # GET routes
+├── Chromium/Convert/                # POST routes grouped by module
+├── Chromium/Screenshot/
+├── LibreOffice/
+└── PDF Engines/<Feature>/           # One folder per feature (Merge, Split, Rotate, ...)
+```
+
+## `.bru` file format
+
+```bru
+meta {
+  name: <Human-readable name>
+  type: http
+  seq: <order within folder>
+}
+
+post {
+  url: {{baseUrl}}/forms/<path>
+  body: multipartForm
+  auth: none
+}
+
+body:multipart-form {
+  files: @file(../../test/integration/testdata/<file>)
+  <mandatoryField>: <value>
+  ~<optionalField>: <value>
+}
+
+headers {
+  ~Gotenberg-Output-Filename: <name>
+  ~Gotenberg-Webhook-Url: http://localhost:8080/webhook
+  ~Gotenberg-Webhook-Error-Url: http://localhost:8080/webhook/error
+  ~Gotenberg-Webhook-Method: POST
+  ~Gotenberg-Webhook-Error-Method: POST
+  ~Gotenberg-Webhook-Extra-Http-Headers: {"X-Custom":"value"}
+}
+```
+
+## Conventions
+
+- Mandatory fields have no prefix. Optional fields use `~` (disabled by default in Bruno).
+- File references use relative paths to `test/integration/testdata/`.
+- Webhook and output filename headers appear on every POST route as optional (`~`).
+- One `.bru` file per request. For routes with read/write variants (e.g., bookmarks, metadata), create separate files in the same folder.
+
+## Checklist
+
+1. Create or update the `.bru` file in the matching folder under `.bruno/`.
+2. Include all form fields from the route handler. Check `FormData*` calls in the route function.
+3. For file upload fields (`files`, `watermark`, `stamp`, `embeds`), use `@file(...)` with a suitable test file.
+4. Verify the URL path matches the route's `Path` field exactly.
+5. For new module folders, keep the naming consistent (e.g., `PDF Engines/Rotate/`).

.bruno/bruno.json

@@ -0,0 +1,6 @@
+{
+  "version": "1",
+  "name": "Gotenberg",
+  "type": "collection",
+  "ignore": ["node_modules", ".git"]
+}

.bruno/collection.bru

@@ -0,0 +1,3 @@
+headers {
+  Gotenberg-Trace: {{traceId}}
+}

.bruno/environments/Demo.bru

@@ -0,0 +1,4 @@
+vars {
+  baseUrl: https://demo.gotenberg.dev
+  traceId: bruno-demo
+}

.bruno/environments/Local.bru

@@ -0,0 +1,4 @@
+vars {
+  baseUrl: http://localhost:3000
+  traceId: bruno-local
+}

.env

@@ -1,13 +1,6 @@
-GOLANG_VERSION=1.24
+GOTENBERG_VERSION=snapshot
 DOCKER_REGISTRY=gotenberg
 DOCKER_REPOSITORY=gotenberg
-GOTENBERG_VERSION=snapshot
-GOTENBERG_USER_GID=1001
-GOTENBERG_USER_UID=1001
-NOTO_COLOR_EMOJI_VERSION=v2.047 # See https://github.com/googlefonts/noto-emoji/releases.
-PDFTK_VERSION=v3.3.3            # See https://gitlab.com/pdftk-java/pdftk/-/releases - Binary package.
-PDFCPU_VERSION=v0.8.1           # See https://github.com/pdfcpu/pdfcpu/releases.
-GOTENBERG_VERSION=snapshot
 DOCKERFILE=build/Dockerfile
-DOCKERFILE_CLOUDRUN=build/Dockerfile.cloudrun
 DOCKER_BUILD_CONTEXT='.'
+TARGET=gotenberg

.github/actions/build-test-push/action.yml

@@ -14,7 +14,7 @@ inputs:
     description: The Docker Hub password
     required: true
   platform:
-    description: linux/amd64, linux/386, linux/arm64, linux/arm/v7
+    description: linux/amd64, linux/ppc64le, linux/386, linux/arm64, linux/arm/v7
     required: true
   version:
     description: Gotenberg version
@@ -29,11 +29,32 @@ inputs:
 
 outputs:
   tags:
-    description: Comma separated list of tag
+    description: Comma separated list of full variant tags
     value: ${{ steps.build.outputs.tags }}
+  tags_chromium:
+    description: Comma separated list of Chromium variant tags
+    value: ${{ steps.build.outputs.tags_chromium }}
+  tags_libreoffice:
+    description: Comma separated list of LibreOffice variant tags
+    value: ${{ steps.build.outputs.tags_libreoffice }}
   tags_cloud_run:
-    description: Comma separated list of Cloud Run tags (linux/amd64 only)
+    description: Comma separated list of Cloud Run full variant tags (linux/amd64 only)
     value: ${{ steps.build.outputs.tags_cloud_run }}
+  tags_cloud_run_chromium:
+    description: Comma separated list of Cloud Run Chromium variant tags (linux/amd64 only)
+    value: ${{ steps.build.outputs.tags_cloud_run_chromium }}
+  tags_cloud_run_libreoffice:
+    description: Comma separated list of Cloud Run LibreOffice variant tags (linux/amd64 only)
+    value: ${{ steps.build.outputs.tags_cloud_run_libreoffice }}
+  tags_aws_lambda:
+    description: Comma separated list of AWS Lambda full variant tags (linux/amd64 and linux/arm64 only)
+    value: ${{ steps.build.outputs.tags_aws_lambda }}
+  tags_aws_lambda_chromium:
+    description: Comma separated list of AWS Lambda Chromium variant tags (linux/amd64 and linux/arm64 only)
+    value: ${{ steps.build.outputs.tags_aws_lambda_chromium }}
+  tags_aws_lambda_libreoffice:
+    description: Comma separated list of AWS Lambda LibreOffice variant tags (linux/amd64 and linux/arm64 only)
+    value: ${{ steps.build.outputs.tags_aws_lambda_libreoffice }}
 
 runs:
   using: composite
@@ -45,9 +66,10 @@ runs:
       uses: docker/setup-buildx-action@v3
 
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
 
     - name: Log in to Docker Hub
+      if: inputs.docker_hub_username != ''
       uses: docker/login-action@v3
       with:
         username: ${{ inputs.docker_hub_username }}
@@ -56,32 +78,53 @@ runs:
     - name: Build ${{ inputs.platform }}
       id: build
       shell: bash
+      env:
+        INPUT_VERSION: ${{ inputs.version }}
+        INPUT_PLATFORM: ${{ inputs.platform }}
+        INPUT_ALTERNATE_REPOSITORY: ${{ inputs.alternate_repository }}
+        INPUT_DRY_RUN: ${{ inputs.dry_run }}
       run: |
         .github/actions/build-test-push/build.sh \
-          --version "${{ inputs.version }}" \
-          --platform "${{ inputs.platform }}" \
-          --alternate-repository "${{ inputs.alternate_repository }}" \
-          --dry-run "${{ inputs.dry_run }}"
+          --version "$INPUT_VERSION" \
+          --platform "$INPUT_PLATFORM" \
+          --alternate-repository "$INPUT_ALTERNATE_REPOSITORY" \
+          --dry-run "$INPUT_DRY_RUN"
 
     - name: Run integration tests
-      if: ${{ inputs.skip_integrations_tests != 'true' }}
+      if: inputs.skip_integrations_tests != 'true'
       shell: bash
+      env:
+        INPUT_VERSION: ${{ inputs.version }}
+        INPUT_PLATFORM: ${{ inputs.platform }}
+        INPUT_ALTERNATE_REPOSITORY: ${{ inputs.alternate_repository }}
+        INPUT_DRY_RUN: ${{ inputs.dry_run }}
       run: |
         .github/actions/build-test-push/test.sh \
-          --version "${{ inputs.version }}" \
-          --platform "${{ inputs.platform }}" \
-          --alternate-repository "${{ inputs.alternate_repository }}" \
-          --dry-run "${{ inputs.dry_run }}"
+          --version "$INPUT_VERSION" \
+          --platform "$INPUT_PLATFORM" \
+          --alternate-repository "$INPUT_ALTERNATE_REPOSITORY" \
+          --dry-run "$INPUT_DRY_RUN"
 
     - name: Push
+      if: inputs.docker_hub_username != ''
       shell: bash
+      env:
+        INPUT_TAGS: ${{ steps.build.outputs.tags }},${{ steps.build.outputs.tags_chromium }},${{ steps.build.outputs.tags_libreoffice }},${{ steps.build.outputs.tags_cloud_run }},${{ steps.build.outputs.tags_cloud_run_chromium }},${{ steps.build.outputs.tags_cloud_run_libreoffice }},${{ steps.build.outputs.tags_aws_lambda }},${{ steps.build.outputs.tags_aws_lambda_chromium }},${{ steps.build.outputs.tags_aws_lambda_libreoffice }}
+        INPUT_DRY_RUN: ${{ inputs.dry_run }}
       run: |
         .github/actions/build-test-push/push.sh \
-          --tags "${{ steps.build.outputs.tags }},${{ steps.build.outputs.tags_cloud_run }}" \
-          --dry-run "${{ inputs.dry_run }}"
+          --tags "$INPUT_TAGS" \
+          --dry-run "$INPUT_DRY_RUN"
 
     - name: Outputs
       shell: bash
       run: |
         echo "tags=${{ steps.build.outputs.tags }}"
+        echo "tags_chromium=${{ steps.build.outputs.tags_chromium }}"
+        echo "tags_libreoffice=${{ steps.build.outputs.tags_libreoffice }}"
         echo "tags_cloud_run=${{ steps.build.outputs.tags_cloud_run }}"
+        echo "tags_cloud_run_chromium=${{ steps.build.outputs.tags_cloud_run_chromium }}"
+        echo "tags_cloud_run_libreoffice=${{ steps.build.outputs.tags_cloud_run_libreoffice }}"
+        echo "tags_aws_lambda=${{ steps.build.outputs.tags_aws_lambda }}"
+        echo "tags_aws_lambda_chromium=${{ steps.build.outputs.tags_aws_lambda_chromium }}"
+        echo "tags_aws_lambda_libreoffice=${{ steps.build.outputs.tags_aws_lambda_libreoffice }}"

.github/actions/build-test-push/build.sh

@@ -55,7 +55,14 @@ fi
 
 # Build tags arrays.
 tags=()
+tags_chromium=()
+tags_libreoffice=()
 tags_cloud_run=()
+tags_cloud_run_chromium=()
+tags_cloud_run_libreoffice=()
+tags_aws_lambda=()
+tags_aws_lambda_chromium=()
+tags_aws_lambda_libreoffice=()
 
 IFS='/' read -ra arch <<< "$platform"
 IFS='.' read -ra semver <<< "$version"
@@ -68,39 +75,95 @@ if [ "${#semver[@]}" -eq 3 ]; then
   minor="${semver[1]}"
   patch="${semver[2]}"
 
-  tags+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:latest-${arch[1]}")
-  tags+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$major-${arch[1]}")
-  tags+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$major.$minor-${arch[1]}")
-  tags+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$major.$minor.$patch-${arch[1]}")
+  for suffix in "latest" "$major" "$major.$minor" "$major.$minor.$patch"; do
+    tags+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$suffix-${arch[1]}")
+    tags_chromium+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$suffix-chromium-${arch[1]}")
+    tags_libreoffice+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$suffix-libreoffice-${arch[1]}")
+  done
 
   if [ "$platform" = "linux/amd64" ]; then
-    tags_cloud_run+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:latest-cloudrun")
-    tags_cloud_run+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$major-cloudrun")
-    tags_cloud_run+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$major.$minor-cloudrun")
-    tags_cloud_run+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$major.$minor.$patch-cloudrun")
+    for suffix in "latest" "$major" "$major.$minor" "$major.$minor.$patch"; do
+      tags_cloud_run+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$suffix-cloudrun")
+      tags_cloud_run_chromium+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$suffix-chromium-cloudrun")
+      tags_cloud_run_libreoffice+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$suffix-libreoffice-cloudrun")
+    done
+  fi
+
+  if [ "$platform" = "linux/amd64" ] || [ "$platform" = "linux/arm64" ]; then
+    for suffix in "latest" "$major" "$major.$minor" "$major.$minor.$patch"; do
+      tags_aws_lambda+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$suffix-aws-lambda-${arch[1]}")
+      tags_aws_lambda_chromium+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$suffix-chromium-aws-lambda-${arch[1]}")
+      tags_aws_lambda_libreoffice+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$suffix-libreoffice-aws-lambda-${arch[1]}")
+    done
   fi
 else
   echo
   echo "Non-semver version detected, fallback to $version"
 
   tags+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version-${arch[1]}")
+  tags_chromium+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version-chromium-${arch[1]}")
+  tags_libreoffice+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version-libreoffice-${arch[1]}")
+
   if [ "$platform" = "linux/amd64" ]; then
     tags_cloud_run+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version-cloudrun")
+    tags_cloud_run_chromium+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version-chromium-cloudrun")
+    tags_cloud_run_libreoffice+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version-libreoffice-cloudrun")
+  fi
+
+  if [ "$platform" = "linux/amd64" ] || [ "$platform" = "linux/arm64" ]; then
+    tags_aws_lambda+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version-aws-lambda-${arch[1]}")
+    tags_aws_lambda_chromium+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version-chromium-aws-lambda-${arch[1]}")
+    tags_aws_lambda_libreoffice+=("$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version-libreoffice-aws-lambda-${arch[1]}")
   fi
 fi
 
 tags_flags=()
+tags_chromium_flags=()
+tags_libreoffice_flags=()
 tags_cloud_run_flags=()
+tags_cloud_run_chromium_flags=()
+tags_cloud_run_libreoffice_flags=()
+tags_aws_lambda_flags=()
+tags_aws_lambda_chromium_flags=()
+tags_aws_lambda_libreoffice_flags=()
 
 echo "Will use the following tags:"
 for tag in "${tags[@]}"; do
   tags_flags+=("-t" "$tag")
   echo "- $tag"
 done
+for tag in "${tags_chromium[@]}"; do
+  tags_chromium_flags+=("-t" "$tag")
+  echo "- $tag"
+done
+for tag in "${tags_libreoffice[@]}"; do
+  tags_libreoffice_flags+=("-t" "$tag")
+  echo "- $tag"
+done
 for tag in "${tags_cloud_run[@]}"; do
   tags_cloud_run_flags+=("-t" "$tag")
   echo "- $tag"
 done
+for tag in "${tags_cloud_run_chromium[@]}"; do
+  tags_cloud_run_chromium_flags+=("-t" "$tag")
+  echo "- $tag"
+done
+for tag in "${tags_cloud_run_libreoffice[@]}"; do
+  tags_cloud_run_libreoffice_flags+=("-t" "$tag")
+  echo "- $tag"
+done
+for tag in "${tags_aws_lambda[@]}"; do
+  tags_aws_lambda_flags+=("-t" "$tag")
+  echo "- $tag"
+done
+for tag in "${tags_aws_lambda_chromium[@]}"; do
+  tags_aws_lambda_chromium_flags+=("-t" "$tag")
+  echo "- $tag"
+done
+for tag in "${tags_aws_lambda_libreoffice[@]}"; do
+  tags_aws_lambda_libreoffice_flags+=("-t" "$tag")
+  echo "- $tag"
+done
 echo
 
 # Build images.
@@ -128,14 +191,10 @@ join() {
 
 no_arch_tag="$DOCKER_REGISTRY/$DOCKER_REPOSITORY:$version"
 
+# Full variant.
 cmd="docker buildx build \
-    --build-arg GOLANG_VERSION=$GOLANG_VERSION \
+    --target gotenberg \
     --build-arg GOTENBERG_VERSION=$version \
-    --build-arg GOTENBERG_USER_GID=$GOTENBERG_USER_GID \
-    --build-arg GOTENBERG_USER_UID=$GOTENBERG_USER_UID \
-    --build-arg NOTO_COLOR_EMOJI_VERSION=$NOTO_COLOR_EMOJI_VERSION \
-    --build-arg PDFTK_VERSION=$PDFTK_VERSION \
-    --build-arg PDFCPU_VERSION=$PDFCPU_VERSION \
     --platform $platform \
     --load \
     ${tags_flags[*]} \
@@ -144,24 +203,102 @@ cmd="docker buildx build \
 "
 run_cmd "$cmd"
 
-if [ "$platform" != "linux/amd64" ]; then
-  echo "⚠️ Skip Cloud Run variant(s)"
-  echo "✅ Done!"
-  echo "tags=$(join "," "${tags[@]}")" >> "$GITHUB_OUTPUT"
-  echo "tags_cloud_run=$(join "," "${tags_cloud_run[@]}")" >> "$GITHUB_OUTPUT"
-  exit 0
-fi
-
-cmd="docker build \
-    --build-arg DOCKER_REGISTRY=$DOCKER_REGISTRY \
-    --build-arg DOCKER_REPOSITORY=$DOCKER_REPOSITORY \
+# Chromium only variant.
+cmd="docker buildx build \
+    --target gotenberg-chromium \
     --build-arg GOTENBERG_VERSION=$version \
-    ${tags_cloud_run_flags[*]} \
-    -f $DOCKERFILE_CLOUDRUN $DOCKER_BUILD_CONTEXT
+    --platform $platform \
+    --load \
+    ${tags_chromium_flags[*]} \
+    -f $DOCKERFILE $DOCKER_BUILD_CONTEXT
 "
 run_cmd "$cmd"
 
+# LibreOffice only variant.
+cmd="docker buildx build \
+    --target gotenberg-libreoffice \
+    --build-arg GOTENBERG_VERSION=$version \
+    --platform $platform \
+    --load \
+    ${tags_libreoffice_flags[*]} \
+    -f $DOCKERFILE $DOCKER_BUILD_CONTEXT
+"
+run_cmd "$cmd"
+
+# Cloud Run variants (amd64 only).
+if [ "$platform" = "linux/amd64" ]; then
+  cmd="docker buildx build \
+      --target gotenberg-cloudrun \
+      --build-arg GOTENBERG_VERSION=$version \
+      --platform $platform \
+      --load \
+      ${tags_cloud_run_flags[*]} \
+      -f $DOCKERFILE $DOCKER_BUILD_CONTEXT
+  "
+  run_cmd "$cmd"
+
+  cmd="docker buildx build \
+      --target gotenberg-cloudrun-chromium \
+      --build-arg GOTENBERG_VERSION=$version \
+      --platform $platform \
+      --load \
+      ${tags_cloud_run_chromium_flags[*]} \
+      -f $DOCKERFILE $DOCKER_BUILD_CONTEXT
+  "
+  run_cmd "$cmd"
+
+  cmd="docker buildx build \
+      --target gotenberg-cloudrun-libreoffice \
+      --build-arg GOTENBERG_VERSION=$version \
+      --platform $platform \
+      --load \
+      ${tags_cloud_run_libreoffice_flags[*]} \
+      -f $DOCKERFILE $DOCKER_BUILD_CONTEXT
+  "
+  run_cmd "$cmd"
+fi
+
+# AWS Lambda variants (amd64 + arm64 only).
+if [ "$platform" = "linux/amd64" ] || [ "$platform" = "linux/arm64" ]; then
+  cmd="docker buildx build \
+      --target gotenberg-aws-lambda \
+      --build-arg GOTENBERG_VERSION=$version \
+      --platform $platform \
+      --load \
+      ${tags_aws_lambda_flags[*]} \
+      -f $DOCKERFILE $DOCKER_BUILD_CONTEXT
+  "
+  run_cmd "$cmd"
+
+  cmd="docker buildx build \
+      --target gotenberg-aws-lambda-chromium \
+      --build-arg GOTENBERG_VERSION=$version \
+      --platform $platform \
+      --load \
+      ${tags_aws_lambda_chromium_flags[*]} \
+      -f $DOCKERFILE $DOCKER_BUILD_CONTEXT
+  "
+  run_cmd "$cmd"
+
+  cmd="docker buildx build \
+      --target gotenberg-aws-lambda-libreoffice \
+      --build-arg GOTENBERG_VERSION=$version \
+      --platform $platform \
+      --load \
+      ${tags_aws_lambda_libreoffice_flags[*]} \
+      -f $DOCKERFILE $DOCKER_BUILD_CONTEXT
+  "
+  run_cmd "$cmd"
+fi
+
 echo "✅ Done!"
 echo "tags=$(join "," "${tags[@]}")" >> "$GITHUB_OUTPUT"
+echo "tags_chromium=$(join "," "${tags_chromium[@]}")" >> "$GITHUB_OUTPUT"
+echo "tags_libreoffice=$(join "," "${tags_libreoffice[@]}")" >> "$GITHUB_OUTPUT"
 echo "tags_cloud_run=$(join "," "${tags_cloud_run[@]}")" >> "$GITHUB_OUTPUT"
+echo "tags_cloud_run_chromium=$(join "," "${tags_cloud_run_chromium[@]}")" >> "$GITHUB_OUTPUT"
+echo "tags_cloud_run_libreoffice=$(join "," "${tags_cloud_run_libreoffice[@]}")" >> "$GITHUB_OUTPUT"
+echo "tags_aws_lambda=$(join "," "${tags_aws_lambda[@]}")" >> "$GITHUB_OUTPUT"
+echo "tags_aws_lambda_chromium=$(join "," "${tags_aws_lambda_chromium[@]}")" >> "$GITHUB_OUTPUT"
+echo "tags_aws_lambda_libreoffice=$(join "," "${tags_aws_lambda_libreoffice[@]}")" >> "$GITHUB_OUTPUT"
 exit 0

.github/actions/build-test-push/push.sh

@@ -32,7 +32,13 @@ echo "Push tag(s) 📦"
 echo
 
 echo "Tag(s) to push:"
-IFS=',' read -ra tags_to_push <<< "$tags"
+IFS=',' read -ra tmp_tags_to_push <<< "$tags"
+
+tags_to_push=()
+for tag in "${tmp_tags_to_push[@]}"; do
+  [ -n "$tag" ] && tags_to_push+=("$tag")
+done
+
 for tag in "${tags_to_push[@]}"; do
   echo "- $tag"
 done

.github/actions/clean/action.yml

@@ -23,9 +23,12 @@ runs:
       env:
         DOCKERHUB_USERNAME: ${{ inputs.docker_hub_username }}
         DOCKERHUB_TOKEN: ${{ inputs.docker_hub_password }}
+        INPUT_TAGS: ${{ inputs.tags }}
+        INPUT_SNAPSHOT_VERSION: ${{ inputs.snapshot_version }}
+        INPUT_DRY_RUN: ${{ inputs.dry_run }}
       shell: bash
       run: |
         .github/actions/clean/clean.sh \
-          --tags "${{ inputs.tags }}" \
-          --snapshot-version "${{ inputs.snapshot_version }}" \
-          --dry-run "${{ inputs.dry_run }}"
+          --tags "$INPUT_TAGS" \
+          --snapshot-version "$INPUT_SNAPSHOT_VERSION" \
+          --dry-run "$INPUT_DRY_RUN"

.github/actions/clean/clean.sh

@@ -40,6 +40,7 @@ IFS=',' read -ra tags_to_delete <<< "$tags"
 if [ -n "$snapshot_version" ]; then
   tags_to_delete+=("$DOCKER_REGISTRY/snapshot:$snapshot_version")
   tags_to_delete+=("$DOCKER_REGISTRY/snapshot:$snapshot_version-cloudrun")
+  tags_to_delete+=("$DOCKER_REGISTRY/snapshot:$snapshot_version-aws-lambda")
 fi
 
 echo "Will delete the following tag(s):"

.github/actions/merge/action.yml

@@ -31,7 +31,7 @@ runs:
       uses: docker/setup-buildx-action@v3
 
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
 
     - name: Log in to Docker Hub
       uses: docker/login-action@v3
@@ -41,8 +41,12 @@ runs:
 
     - name: Merge
       shell: bash
+      env:
+        INPUT_TAGS: ${{ inputs.tags }}
+        INPUT_ALTERNATE_REGISTRY: ${{ inputs.alternate_registry }}
+        INPUT_DRY_RUN: ${{ inputs.dry_run }}
       run: |
         .github/actions/merge/merge.sh \
-          --tags "${{ inputs.tags }}" \
-          --alternate-registry "${{ inputs.alternate_registry }}" \
-          --dry-run "${{ inputs.dry_run }}"
+          --tags "$INPUT_TAGS" \
+          --alternate-registry "$INPUT_ALTERNATE_REGISTRY" \
+          --dry-run "$INPUT_DRY_RUN"

.github/actions/merge/merge.sh

@@ -56,6 +56,7 @@ declare -A merge_map
 
 for tag in "${tags_to_merge[@]}"; do
   target_tag="${tag//-amd64/}"
+  target_tag="${target_tag//-ppc64le/}"
   target_tag="${target_tag//-arm64/}"
   target_tag="${target_tag//-arm/}"
   target_tag="${target_tag//-386/}"

.github/dependabot.yml

@@ -1,7 +1,20 @@
 version: 2
 updates:
-  # Maintain dependencies for GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+  - package-ecosystem: "docker"
+    directory: "/build"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/continuous-delivery.yml

@@ -13,10 +13,17 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       tags: ${{ steps.build_push.outputs.tags }}
+      tags_chromium: ${{ steps.build_push.outputs.tags_chromium }}
+      tags_libreoffice: ${{ steps.build_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_push.outputs.tags_cloud_run }}
+      tags_cloud_run_chromium: ${{ steps.build_push.outputs.tags_cloud_run_chromium }}
+      tags_cloud_run_libreoffice: ${{ steps.build_push.outputs.tags_cloud_run_libreoffice }}
+      tags_aws_lambda: ${{ steps.build_push.outputs.tags_aws_lambda }}
+      tags_aws_lambda_chromium: ${{ steps.build_push.outputs.tags_aws_lambda_chromium }}
+      tags_aws_lambda_libreoffice: ${{ steps.build_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Build and push
         id: build_push
@@ -33,10 +40,17 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       tags: ${{ steps.build_push.outputs.tags }}
+      tags_chromium: ${{ steps.build_push.outputs.tags_chromium }}
+      tags_libreoffice: ${{ steps.build_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_push.outputs.tags_cloud_run }}
+      tags_cloud_run_chromium: ${{ steps.build_push.outputs.tags_cloud_run_chromium }}
+      tags_cloud_run_libreoffice: ${{ steps.build_push.outputs.tags_cloud_run_libreoffice }}
+      tags_aws_lambda: ${{ steps.build_push.outputs.tags_aws_lambda }}
+      tags_aws_lambda_chromium: ${{ steps.build_push.outputs.tags_aws_lambda_chromium }}
+      tags_aws_lambda_libreoffice: ${{ steps.build_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Build and push
         id: build_push
@@ -48,15 +62,49 @@ jobs:
           platform: linux/386
           skip_integrations_tests: true
 
+  release_ppc64le:
+    name: Release linux/ppc64le
+    runs-on: ubuntu-24.04-ppc64le
+    outputs:
+      tags: ${{ steps.build_push.outputs.tags }}
+      tags_chromium: ${{ steps.build_push.outputs.tags_chromium }}
+      tags_libreoffice: ${{ steps.build_push.outputs.tags_libreoffice }}
+      tags_cloud_run: ${{ steps.build_push.outputs.tags_cloud_run }}
+      tags_cloud_run_chromium: ${{ steps.build_push.outputs.tags_cloud_run_chromium }}
+      tags_cloud_run_libreoffice: ${{ steps.build_push.outputs.tags_cloud_run_libreoffice }}
+      tags_aws_lambda: ${{ steps.build_push.outputs.tags_aws_lambda }}
+      tags_aws_lambda_chromium: ${{ steps.build_push.outputs.tags_aws_lambda_chromium }}
+      tags_aws_lambda_libreoffice: ${{ steps.build_push.outputs.tags_aws_lambda_libreoffice }}
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@v6
+
+      - name: Build and push
+        id: build_push
+        uses: ./.github/actions/build-test-push
+        with:
+          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
+          version: ${{ github.event.release.tag_name }}
+          platform: linux/ppc64le
+          skip_integrations_tests: true
+
   release_arm64:
     name: Release linux/arm64
     runs-on: ubuntu-24.04-arm
     outputs:
       tags: ${{ steps.build_push.outputs.tags }}
+      tags_chromium: ${{ steps.build_push.outputs.tags_chromium }}
+      tags_libreoffice: ${{ steps.build_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_push.outputs.tags_cloud_run }}
+      tags_cloud_run_chromium: ${{ steps.build_push.outputs.tags_cloud_run_chromium }}
+      tags_cloud_run_libreoffice: ${{ steps.build_push.outputs.tags_cloud_run_libreoffice }}
+      tags_aws_lambda: ${{ steps.build_push.outputs.tags_aws_lambda }}
+      tags_aws_lambda_chromium: ${{ steps.build_push.outputs.tags_aws_lambda_chromium }}
+      tags_aws_lambda_libreoffice: ${{ steps.build_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Build and push
         id: build_push
@@ -73,10 +121,17 @@ jobs:
     runs-on: ubuntu-24.04-arm
     outputs:
       tags: ${{ steps.build_push.outputs.tags }}
+      tags_chromium: ${{ steps.build_push.outputs.tags_chromium }}
+      tags_libreoffice: ${{ steps.build_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_push.outputs.tags_cloud_run }}
+      tags_cloud_run_chromium: ${{ steps.build_push.outputs.tags_cloud_run_chromium }}
+      tags_cloud_run_libreoffice: ${{ steps.build_push.outputs.tags_cloud_run_libreoffice }}
+      tags_aws_lambda: ${{ steps.build_push.outputs.tags_aws_lambda }}
+      tags_aws_lambda_chromium: ${{ steps.build_push.outputs.tags_aws_lambda_chromium }}
+      tags_aws_lambda_libreoffice: ${{ steps.build_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Build and push
         id: build_push
@@ -92,25 +147,60 @@ jobs:
     needs:
       - release_amd64
       - release_386
+      - release_ppc64le
       - release_arm64
       - release_arm_v7
     name: Merge and clean release tags
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Merge
         uses: ./.github/actions/merge
         with:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.release_amd64.outputs.tags }},${{ needs.release_386.outputs.tags }},${{ needs.release_arm64.outputs.tags }},${{ needs.release_arm_v7.outputs.tags }}"
-          alternate_registry: thecodingmachine
+          tags: "${{ needs.release_amd64.outputs.tags }},${{ needs.release_386.outputs.tags }},${{ needs.release_ppc64le.outputs.tags }},${{ needs.release_arm64.outputs.tags }},${{ needs.release_arm_v7.outputs.tags }}"
+
+      - name: Merge Chromium
+        uses: ./.github/actions/merge
+        with:
+          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
+          tags: "${{ needs.release_amd64.outputs.tags_chromium }},${{ needs.release_386.outputs.tags_chromium }},${{ needs.release_ppc64le.outputs.tags_chromium }},${{ needs.release_arm64.outputs.tags_chromium }},${{ needs.release_arm_v7.outputs.tags_chromium }}"
+
+      - name: Merge LibreOffice
+        uses: ./.github/actions/merge
+        with:
+          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
+          tags: "${{ needs.release_amd64.outputs.tags_libreoffice }},${{ needs.release_386.outputs.tags_libreoffice }},${{ needs.release_ppc64le.outputs.tags_libreoffice }},${{ needs.release_arm64.outputs.tags_libreoffice }},${{ needs.release_arm_v7.outputs.tags_libreoffice }}"
+
+      - name: Merge AWS Lambda
+        uses: ./.github/actions/merge
+        with:
+          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
+          tags: "${{ needs.release_amd64.outputs.tags_aws_lambda }},${{ needs.release_arm64.outputs.tags_aws_lambda }}"
+
+      - name: Merge AWS Lambda Chromium
+        uses: ./.github/actions/merge
+        with:
+          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
+          tags: "${{ needs.release_amd64.outputs.tags_aws_lambda_chromium }},${{ needs.release_arm64.outputs.tags_aws_lambda_chromium }}"
+
+      - name: Merge AWS Lambda LibreOffice
+        uses: ./.github/actions/merge
+        with:
+          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
+          tags: "${{ needs.release_amd64.outputs.tags_aws_lambda_libreoffice }},${{ needs.release_arm64.outputs.tags_aws_lambda_libreoffice }}"
 
       - name: Clean
         uses: ./.github/actions/clean
         with:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.release_amd64.outputs.tags }},${{ needs.release_386.outputs.tags }},${{ needs.release_arm64.outputs.tags }},${{ needs.release_arm_v7.outputs.tags }}"
+          tags: "${{ needs.release_amd64.outputs.tags }},${{ needs.release_386.outputs.tags }},${{ needs.release_ppc64le.outputs.tags }},${{ needs.release_arm64.outputs.tags }},${{ needs.release_arm_v7.outputs.tags }},${{ needs.release_amd64.outputs.tags_chromium }},${{ needs.release_386.outputs.tags_chromium }},${{ needs.release_ppc64le.outputs.tags_chromium }},${{ needs.release_arm64.outputs.tags_chromium }},${{ needs.release_arm_v7.outputs.tags_chromium }},${{ needs.release_amd64.outputs.tags_libreoffice }},${{ needs.release_386.outputs.tags_libreoffice }},${{ needs.release_ppc64le.outputs.tags_libreoffice }},${{ needs.release_arm64.outputs.tags_libreoffice }},${{ needs.release_arm_v7.outputs.tags_libreoffice }},${{ needs.release_amd64.outputs.tags_aws_lambda }},${{ needs.release_arm64.outputs.tags_aws_lambda }},${{ needs.release_amd64.outputs.tags_aws_lambda_chromium }},${{ needs.release_arm64.outputs.tags_aws_lambda_chromium }},${{ needs.release_amd64.outputs.tags_aws_lambda_libreoffice }},${{ needs.release_arm64.outputs.tags_aws_lambda_libreoffice }}"

.github/workflows/continuous-integration.yml

@@ -21,32 +21,32 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
 
       - name: Run linters
-        uses: golangci/golangci-lint-action@v7
+        uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.0.2
+          version: v2.10.1
 
   lint-prettier:
     name: Lint non-Golang codebase
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: .node-version
 
       - name: Install Dependencies
-        run: npm i
+        run: npm ci --ignore-scripts
 
       - name: Run linters
         run: make lint-prettier
@@ -59,10 +59,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
 
@@ -77,10 +77,17 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       tags: ${{ steps.build_test_push.outputs.tags }}
+      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
+      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
+      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
+      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
+      tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
+      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
+      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Build, test and push
         id: build_test_push
@@ -92,6 +99,36 @@ jobs:
           platform: linux/amd64
           alternate_repository: snapshot
 
+  snapshot_ppc64le:
+    if: github.event_name == 'pull_request'
+    needs:
+      - test-unit
+    name: Snapshot linux/ppc64le
+    runs-on: ubuntu-24.04-ppc64le
+    outputs:
+      tags: ${{ steps.build_test_push.outputs.tags }}
+      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
+      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
+      tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
+      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
+      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
+      tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
+      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
+      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@v6
+
+      - name: Build, test and push
+        id: build_test_push
+        uses: ./.github/actions/build-test-push
+        with:
+          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
+          version: pr-${{ github.event.pull_request.number }}
+          platform: linux/ppc64le
+          alternate_repository: snapshot
+
   snapshot_386:
     if: github.event_name == 'pull_request'
     needs:
@@ -100,10 +137,17 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       tags: ${{ steps.build_test_push.outputs.tags }}
+      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
+      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
+      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
+      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
+      tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
+      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
+      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Build, test and push
         id: build_test_push
@@ -123,10 +167,17 @@ jobs:
     runs-on: ubuntu-24.04-arm
     outputs:
       tags: ${{ steps.build_test_push.outputs.tags }}
+      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
+      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
+      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
+      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
+      tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
+      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
+      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Build, test and push
         id: build_test_push
@@ -146,10 +197,17 @@ jobs:
     runs-on: ubuntu-24.04-arm
     outputs:
       tags: ${{ steps.build_test_push.outputs.tags }}
+      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
+      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
+      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
+      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
+      tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
+      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
+      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Build, test and push
         id: build_test_push
@@ -161,31 +219,90 @@ jobs:
           platform: linux/arm/v7
           alternate_repository: snapshot
 
-  merge_clean_snapshot_tags:
+  merge_clean_snapshot_guard:
     needs:
       - snapshot_amd64
       - snapshot_386
+      - snapshot_ppc64le
+      - snapshot_arm64
+      - snapshot_arm_v7
+    name: Secrets access check
+    runs-on: ubuntu-latest
+    outputs:
+      continue: ${{ steps.check.outputs.continue }}
+    steps:
+      - name: Check
+        id: check
+        run: |
+          if [ -n "${{ secrets.DOCKERHUB_USERNAME }}" ]; then
+            echo "continue=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "continue=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  merge_clean_snapshot_tags:
+    if: needs.merge_clean_snapshot_guard.outputs.continue == 'true'
+    needs:
+      - merge_clean_snapshot_guard
+      - snapshot_amd64
+      - snapshot_386
+      - snapshot_ppc64le
       - snapshot_arm64
       - snapshot_arm_v7
     name: Merge and clean snapshot tags
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Merge
         uses: ./.github/actions/merge
         with:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.snapshot_amd64.outputs.tags }},${{ needs.snapshot_386.outputs.tags }},${{ needs.snapshot_arm64.outputs.tags }},${{ needs.snapshot_arm_v7.outputs.tags }}"
+          tags: "${{ needs.snapshot_amd64.outputs.tags }},${{ needs.snapshot_386.outputs.tags }},${{ needs.snapshot_ppc64le.outputs.tags }},${{ needs.snapshot_arm64.outputs.tags }},${{ needs.snapshot_arm_v7.outputs.tags }}"
+
+      - name: Merge Chromium
+        uses: ./.github/actions/merge
+        with:
+          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
+          tags: "${{ needs.snapshot_amd64.outputs.tags_chromium }},${{ needs.snapshot_386.outputs.tags_chromium }},${{ needs.snapshot_ppc64le.outputs.tags_chromium }},${{ needs.snapshot_arm64.outputs.tags_chromium }},${{ needs.snapshot_arm_v7.outputs.tags_chromium }}"
+
+      - name: Merge LibreOffice
+        uses: ./.github/actions/merge
+        with:
+          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
+          tags: "${{ needs.snapshot_amd64.outputs.tags_libreoffice }},${{ needs.snapshot_386.outputs.tags_libreoffice }},${{ needs.snapshot_ppc64le.outputs.tags_libreoffice }},${{ needs.snapshot_arm64.outputs.tags_libreoffice }},${{ needs.snapshot_arm_v7.outputs.tags_libreoffice }}"
+
+      - name: Merge AWS Lambda
+        uses: ./.github/actions/merge
+        with:
+          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
+          tags: "${{ needs.snapshot_amd64.outputs.tags_aws_lambda }},${{ needs.snapshot_arm64.outputs.tags_aws_lambda }}"
+
+      - name: Merge AWS Lambda Chromium
+        uses: ./.github/actions/merge
+        with:
+          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
+          tags: "${{ needs.snapshot_amd64.outputs.tags_aws_lambda_chromium }},${{ needs.snapshot_arm64.outputs.tags_aws_lambda_chromium }}"
+
+      - name: Merge AWS Lambda LibreOffice
+        uses: ./.github/actions/merge
+        with:
+          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
+          tags: "${{ needs.snapshot_amd64.outputs.tags_aws_lambda_libreoffice }},${{ needs.snapshot_arm64.outputs.tags_aws_lambda_libreoffice }}"
 
       - name: Clean
         uses: ./.github/actions/clean
         with:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.snapshot_amd64.outputs.tags }},${{ needs.snapshot_386.outputs.tags }},${{ needs.snapshot_arm64.outputs.tags }},${{ needs.snapshot_arm_v7.outputs.tags }}"
+          tags: "${{ needs.snapshot_amd64.outputs.tags }},${{ needs.snapshot_386.outputs.tags }},${{ needs.snapshot_ppc64le.outputs.tags }},${{ needs.snapshot_arm64.outputs.tags }},${{ needs.snapshot_arm_v7.outputs.tags }},${{ needs.snapshot_amd64.outputs.tags_chromium }},${{ needs.snapshot_386.outputs.tags_chromium }},${{ needs.snapshot_ppc64le.outputs.tags_chromium }},${{ needs.snapshot_arm64.outputs.tags_chromium }},${{ needs.snapshot_arm_v7.outputs.tags_chromium }},${{ needs.snapshot_amd64.outputs.tags_libreoffice }},${{ needs.snapshot_386.outputs.tags_libreoffice }},${{ needs.snapshot_ppc64le.outputs.tags_libreoffice }},${{ needs.snapshot_arm64.outputs.tags_libreoffice }},${{ needs.snapshot_arm_v7.outputs.tags_libreoffice }},${{ needs.snapshot_amd64.outputs.tags_aws_lambda }},${{ needs.snapshot_arm64.outputs.tags_aws_lambda }},${{ needs.snapshot_amd64.outputs.tags_aws_lambda_chromium }},${{ needs.snapshot_arm64.outputs.tags_aws_lambda_chromium }},${{ needs.snapshot_amd64.outputs.tags_aws_lambda_libreoffice }},${{ needs.snapshot_arm64.outputs.tags_aws_lambda_libreoffice }}"
 
   edge_amd64:
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
@@ -195,10 +312,17 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       tags: ${{ steps.build_test_push.outputs.tags }}
+      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
+      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
+      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
+      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
+      tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
+      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
+      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Build, test and push
         id: build_test_push
@@ -217,10 +341,17 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       tags: ${{ steps.build_test_push.outputs.tags }}
+      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
+      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
+      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
+      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
+      tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
+      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
+      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Build, test and push
         id: build_test_push
@@ -231,6 +362,35 @@ jobs:
           version: edge
           platform: linux/386
 
+  edge_ppc64le:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs:
+      - test-unit
+    name: Edge linux/ppc64le
+    runs-on: ubuntu-24.04-ppc64le
+    outputs:
+      tags: ${{ steps.build_test_push.outputs.tags }}
+      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
+      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
+      tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
+      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
+      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
+      tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
+      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
+      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@v6
+
+      - name: Build, test and push
+        id: build_test_push
+        uses: ./.github/actions/build-test-push
+        with:
+          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
+          version: edge
+          platform: linux/ppc64le
+
   edge_arm64:
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     needs:
@@ -239,10 +399,17 @@ jobs:
     runs-on: ubuntu-24.04-arm
     outputs:
       tags: ${{ steps.build_test_push.outputs.tags }}
+      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
+      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
+      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
+      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
+      tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
+      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
+      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Build, test and push
         id: build_test_push
@@ -261,10 +428,17 @@ jobs:
     runs-on: ubuntu-24.04-arm
     outputs:
       tags: ${{ steps.build_test_push.outputs.tags }}
+      tags_chromium: ${{ steps.build_test_push.outputs.tags_chromium }}
+      tags_libreoffice: ${{ steps.build_test_push.outputs.tags_libreoffice }}
       tags_cloud_run: ${{ steps.build_test_push.outputs.tags_cloud_run }}
+      tags_cloud_run_chromium: ${{ steps.build_test_push.outputs.tags_cloud_run_chromium }}
+      tags_cloud_run_libreoffice: ${{ steps.build_test_push.outputs.tags_cloud_run_libreoffice }}
+      tags_aws_lambda: ${{ steps.build_test_push.outputs.tags_aws_lambda }}
+      tags_aws_lambda_chromium: ${{ steps.build_test_push.outputs.tags_aws_lambda_chromium }}
+      tags_aws_lambda_libreoffice: ${{ steps.build_test_push.outputs.tags_aws_lambda_libreoffice }}
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Build, test and push
         id: build_test_push
@@ -279,25 +453,60 @@ jobs:
     needs:
       - edge_amd64
       - edge_386
+      - edge_ppc64le
       - edge_arm64
       - edge_arm_v7
     name: Merge and clean edge tags
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Merge
         uses: ./.github/actions/merge
         with:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.edge_amd64.outputs.tags }},${{ needs.edge_386.outputs.tags }},${{ needs.edge_arm64.outputs.tags }},${{ needs.edge_arm_v7.outputs.tags }}"
-          alternate_registry: thecodingmachine
+          tags: "${{ needs.edge_amd64.outputs.tags }},${{ needs.edge_386.outputs.tags }},${{ needs.edge_ppc64le.outputs.tags }},${{ needs.edge_arm64.outputs.tags }},${{ needs.edge_arm_v7.outputs.tags }}"
+
+      - name: Merge Chromium
+        uses: ./.github/actions/merge
+        with:
+          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
+          tags: "${{ needs.edge_amd64.outputs.tags_chromium }},${{ needs.edge_386.outputs.tags_chromium }},${{ needs.edge_ppc64le.outputs.tags_chromium }},${{ needs.edge_arm64.outputs.tags_chromium }},${{ needs.edge_arm_v7.outputs.tags_chromium }}"
+
+      - name: Merge LibreOffice
+        uses: ./.github/actions/merge
+        with:
+          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
+          tags: "${{ needs.edge_amd64.outputs.tags_libreoffice }},${{ needs.edge_386.outputs.tags_libreoffice }},${{ needs.edge_ppc64le.outputs.tags_libreoffice }},${{ needs.edge_arm64.outputs.tags_libreoffice }},${{ needs.edge_arm_v7.outputs.tags_libreoffice }}"
+
+      - name: Merge AWS Lambda
+        uses: ./.github/actions/merge
+        with:
+          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
+          tags: "${{ needs.edge_amd64.outputs.tags_aws_lambda }},${{ needs.edge_arm64.outputs.tags_aws_lambda }}"
+
+      - name: Merge AWS Lambda Chromium
+        uses: ./.github/actions/merge
+        with:
+          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
+          tags: "${{ needs.edge_amd64.outputs.tags_aws_lambda_chromium }},${{ needs.edge_arm64.outputs.tags_aws_lambda_chromium }}"
+
+      - name: Merge AWS Lambda LibreOffice
+        uses: ./.github/actions/merge
+        with:
+          docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
+          tags: "${{ needs.edge_amd64.outputs.tags_aws_lambda_libreoffice }},${{ needs.edge_arm64.outputs.tags_aws_lambda_libreoffice }}"
 
       - name: Clean
         uses: ./.github/actions/clean
         with:
           docker_hub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_hub_password: ${{ secrets.DOCKERHUB_TOKEN }}
-          tags: "${{ needs.edge_amd64.outputs.tags }},${{ needs.edge_386.outputs.tags }},${{ needs.edge_arm64.outputs.tags }},${{ needs.edge_arm_v7.outputs.tags }}"
+          tags: "${{ needs.edge_amd64.outputs.tags }},${{ needs.edge_386.outputs.tags }},${{ needs.edge_ppc64le.outputs.tags }},${{ needs.edge_arm64.outputs.tags }},${{ needs.edge_arm_v7.outputs.tags }},${{ needs.edge_amd64.outputs.tags_chromium }},${{ needs.edge_386.outputs.tags_chromium }},${{ needs.edge_ppc64le.outputs.tags_chromium }},${{ needs.edge_arm64.outputs.tags_chromium }},${{ needs.edge_arm_v7.outputs.tags_chromium }},${{ needs.edge_amd64.outputs.tags_libreoffice }},${{ needs.edge_386.outputs.tags_libreoffice }},${{ needs.edge_ppc64le.outputs.tags_libreoffice }},${{ needs.edge_arm64.outputs.tags_libreoffice }},${{ needs.edge_arm_v7.outputs.tags_libreoffice }},${{ needs.edge_amd64.outputs.tags_aws_lambda }},${{ needs.edge_arm64.outputs.tags_aws_lambda }},${{ needs.edge_amd64.outputs.tags_aws_lambda_chromium }},${{ needs.edge_arm64.outputs.tags_aws_lambda_chromium }},${{ needs.edge_amd64.outputs.tags_aws_lambda_libreoffice }},${{ needs.edge_arm64.outputs.tags_aws_lambda_libreoffice }}"

.github/workflows/pull-request-cleanup.yml

@@ -11,9 +11,10 @@ jobs:
   cleanup:
     name: Cleanup Docker images
     runs-on: ubuntu-latest
+    continue-on-error: true
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Cleanup
         uses: ./.github/actions/clean

.gitignore

@@ -1,5 +1,3 @@
-/coverage.html
-/coverage.txt
 .idea
 .vscode
 .DS_Store

.golangci.yml

@@ -24,13 +24,14 @@ linters:
     - ineffassign
     - misspell
     - prealloc
-    - promlinter
     - staticcheck
     - testableexamples
     - tparallel
     - unconvert
     - unused
+    - sloglint
     - usetesting
+    - gocritic
     - wastedassign
     - whitespace
   exclusions:
@@ -40,10 +41,6 @@ linters:
       - common-false-positives
       - legacy
       - std-error-handling
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
 formatters:
   enable:
     - gci
@@ -59,7 +56,3 @@ formatters:
       custom-order: true
   exclusions:
     generated: lax
-    paths:
-      - third_party$
-      - builtin$
-      - examples$

.node-version

@@ -1 +1 @@
-23.9.0
+24.15.0

.npmrc

@@ -0,0 +1 @@
+min-release-age=7

AGENTS.md

@@ -0,0 +1 @@
+CONTRIBUTING.md

CLAUDE.md

@@ -0,0 +1 @@
+CONTRIBUTING.md

CONTRIBUTING.md

@@ -0,0 +1,187 @@
+# Contributing to Gotenberg
+
+Gotenberg is a Docker-based API for converting documents to PDF. Two rules override everything else:
+
+- **Backward compatibility.** Never rename or remove CLI flags, environment variables, API form fields, or HTTP endpoints without discussion.
+- **Defensive programming.** Assume input is malformed, handle errors explicitly, never panic.
+
+## Toolchain
+
+- Module: `github.com/gotenberg/gotenberg/v8`
+- Go: see version in `go.mod`
+- Docker
+- Node.js (see `.node-version`), for Prettier linting
+- [golangci-lint](https://golangci-lint.run/) v2+
+
+## Before you start
+
+For non-trivial changes, open an issue or a draft PR first. Describe what needs to change, the proposed solution (files to modify, interface changes, form fields), and which integration test tags are affected.
+
+One thing per PR. Keep features, bug fixes, and refactoring in separate PRs.
+
+When adding a feature or route, write the Gherkin scenario before the Go code, and plan to update the Bruno collection (`.bruno/`) if a route changes.
+
+## Project layout
+
+```
+cmd/gotenberg/       -> Entry point only (wiring/startup). No business logic.
+pkg/gotenberg/       -> Core module system, interfaces, utilities, mocks.
+pkg/modules/         -> Feature modules (api, chromium, libreoffice, pdfengines, etc.).
+pkg/standard/        -> Wires all standard modules together via imports.
+test/integration/    -> Gherkin feature files + Go test infrastructure.
+build/               -> Dockerfile, fonts, Chromium config.
+.bruno/              -> Bruno API collection (mirrors every route).
+```
+
+Key interfaces live in `pkg/gotenberg/`: `Module`, `Provisioner`, `Validator`, `Debuggable`. Every module implements `Descriptor()` and self-registers via `init()`.
+
+## Setup and Makefile
+
+All build and verification tasks go through the Makefile. Do not run `go` commands directly unless debugging a specific package.
+
+| Command                 | Purpose                                          | When to use                                                              |
+| ----------------------- | ------------------------------------------------ | ------------------------------------------------------------------------ |
+| `make build`            | Build the Gotenberg Docker image                 | Before integration tests or manual testing                               |
+| `make run`              | Run a Gotenberg container via `docker compose`   | Manual testing. Flags configured via Makefile variables and compose.yaml |
+| `make telemetry`        | Start an OpenTelemetry collector and OpenObserve | When testing telemetry locally                                           |
+| `make down`             | Stop all compose containers                      | After manual testing                                                     |
+| `make godoc`            | Serve GoDoc at `localhost:6060`                  | To verify documentation                                                  |
+| `make fmt`              | Format Go code                                   | Before committing                                                        |
+| `make lint`             | Lint Go code (zero errors permitted)             | Before committing                                                        |
+| `make prettify`         | Format non-Go files (Markdown, YAML, JSON)       | Before committing                                                        |
+| `make lint-prettier`    | Lint non-Go files                                | Before committing                                                        |
+| `make test-unit`        | Run unit tests                                   | Before committing                                                        |
+| `make test-integration` | Run all integration tests (40 min timeout)       | Before committing                                                        |
+
+Run only the integration test tag(s) relevant to your change rather than the full suite:
+
+```bash
+make test-integration TAGS=health
+make test-integration TAGS=chromium-convert-html
+make test-integration TAGS="merge,split"
+```
+
+## Code conventions
+
+### Module system
+
+Gotenberg uses a self-registering module architecture inspired by CaddyServer. Each module lives in `pkg/modules/<name>/`, implements at minimum `gotenberg.Module` (`Descriptor()`), and self-registers via `init()`. Wiring happens through `pkg/standard/`.
+
+Determine if a feature belongs in an existing module before creating a new one. Only create a new module for a genuinely separate concern.
+
+The `cmd/gotenberg/` package is strictly for wiring and startup. No business logic.
+
+### Backward compatibility
+
+CLI flags, environment variables, API form fields, HTTP endpoints, and default values that alter existing behavior must not change without discussion. Deprecate old names with `fs.MarkDeprecated()` and register both the old and new names side by side.
+
+If a change violates backward compatibility, flag it as a breaking change in the PR description.
+
+### Error handling
+
+- Wrap every error with context: `fmt.Errorf("description: %w", err)`.
+- Never swallow errors silently.
+- Match errors with `errors.Is`, never `strings.Contains`.
+- No panics in production code paths.
+- Validate input defensively.
+
+### Error messages
+
+Client- and operator-facing error messages state what failed, why when non-obvious, and how to fix it when a fix exists. Internal errors (the wrapped `fmt.Errorf` chains that only reach logs) are exempt; keep them precise and technical.
+
+- Client (HTTP response body): name the offending form field and its valid values. Never return a bare `http.StatusText()`.
+- Operator (startup, `Provision`, `Validate`): name the environment variable or flag to set, plus the path or value checked.
+- Security and filtering errors stay generic for clients. Don't reveal allow/deny lists or private-IP policy. Log the specific reason for operators.
+- No hedging ("while others may have failed"). No raw `os.Stat` or exec output in the human-facing remedy.
+
+### Logging
+
+Use `gotenberg.Logger(mod)` to get the module's slog logger during `Provision()`. All log calls must be context-aware: `logger.DebugContext(ctx, msg)`, `logger.InfoContext(ctx, msg)`, `logger.ErrorContext(ctx, msg)`. This propagates trace/span IDs into structured logs when OpenTelemetry is active.
+
+### Telemetry
+
+External tool calls (Chromium, LibreOffice, PDF engines, webhooks, downloads) must create OTEL spans with `trace.SpanKindClient` and `semconv.ServerAddress("toolname")`. Use `gotenberg.Tracer()` and `gotenberg.Meter()` for traces and metrics.
+
+### Import ordering
+
+Enforced by `gci`: standard library, then third-party, then `github.com/gotenberg/gotenberg/v8`. Three groups separated by blank lines.
+
+## Documentation conventions
+
+### Tone
+
+- Short, declarative sentences. Say what it does, then stop.
+- Lead with the action. "Validates font embedding", not "This function validates font embedding".
+- Active voice. "Gotenberg checks the profile", not "The profile is checked by Gotenberg".
+- No em dashes. Use a period, colon, or comma.
+- No "we" hedging. "Don't...", not "We do not recommend...".
+
+### Godoc
+
+Every exported type and function has a Godoc comment starting with its identifier name:
+
+```go
+// Violation records a single rule violation with context.
+type Violation struct { ... }
+
+// ValidatePDFA audits the document against a PDF/A profile.
+func ValidatePDFA(ctx context.Context, ...) ([]error, error)
+```
+
+Each package should have a `doc.go` with a `// Package foo ...` comment.
+
+Reference identifiers with `[Name]` brackets for pkg.go.dev linking:
+
+```go
+// ValidatePDFA returns violations as []error where each element
+// is a [Violation] value. See [Rule] for the structured fields.
+```
+
+### Code comments
+
+- Explain _why_, not _what_.
+- No numbered step comments (`// 1. Do X`, `// 2. Do Y`).
+- No section dividers with numbers (`// --- 8. Foo ---`). Plain dividers are fine for major boundaries.
+- No noise comments that restate the code (`// Check if err is nil`, `// Return results`).
+- Reference spec clauses where relevant (`// Per ISO 32000-2, Table 116...`).
+- Mark debt with `// TODO: [context]`.
+
+## Testing
+
+### Unit tests
+
+Table-driven tests in `*_test.go` files. Use the comprehensive mock implementations in `pkg/gotenberg/mocks.go` rather than rolling new ones.
+
+### Integration tests
+
+Gherkin (BDD) via Godog with `testcontainers-go` for Docker orchestration. Feature files live in `test/integration/features/`; step definitions live in `test/integration/scenario/`. Read `scenario.go` and `containers.go` before writing new tests.
+
+`make build` is required before running integration tests. The full suite has a 40-minute timeout, so run only the tag(s) relevant to your change.
+
+## Pull requests
+
+### Commits
+
+[Conventional Commits](https://www.conventionalcommits.org/): `<type>(<scope>): <description>`.
+
+Common types: `feat`, `fix`, `refactor`, `test`, `docs`, `chore`, `ci`, `build`. The scope matches the module or area of the change (e.g., `chromium`, `pdfengines`, `api`).
+
+Stage specific files. Never `git add -A` or `git add .`.
+
+### Checklist
+
+Before opening the PR, confirm:
+
+- [ ] No backward-compatibility regression. See [Backward compatibility](#backward-compatibility).
+- [ ] Code conventions met (error wrapping, logging, telemetry, import ordering, no panics, no business logic in `cmd/`). See [Code conventions](#code-conventions).
+- [ ] Documentation conventions met (Godoc on every exported identifier, `doc.go` for new packages, tone). See [Documentation conventions](#documentation-conventions).
+- [ ] `make fmt && make lint && make prettify && make lint-prettier` pass with zero warnings.
+- [ ] `make test-unit` passes.
+- [ ] Relevant `make test-integration TAGS=...` passes.
+- [ ] Bruno collection updated if routes were added or modified.
+
+## Further reading
+
+- [`test/integration/README.md`](test/integration/README.md) — Gherkin step reference, available tags, writing new tests.
+- [`.bruno/README.md`](.bruno/README.md) — `.bru` file format, conventions, route update checklist.
+- [`pkg/modules/pdfengines/README.md`](pkg/modules/pdfengines/README.md) — adding new engine features (Makefile variable and flag).

GEMINI.md

@@ -0,0 +1 @@
+CONTRIBUTING.md

Makefile

@@ -5,41 +5,42 @@ help: ## Show the help
 	@grep -hE '^[A-Za-z0-9_ \-]*?:.*##.*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
 
 .PHONY: build
-build: ## Build the Gotenberg's Docker image
+build: ## Build the Gotenberg's Docker image (use TARGET=gotenberg-chromium or TARGET=gotenberg-libreoffice for variants)
 	docker build \
-	--build-arg GOLANG_VERSION=$(GOLANG_VERSION) \
-	--build-arg GOTENBERG_VERSION=$(GOTENBERG_VERSION) \
-	--build-arg GOTENBERG_USER_GID=$(GOTENBERG_USER_GID) \
-	--build-arg GOTENBERG_USER_UID=$(GOTENBERG_USER_UID) \
-	--build-arg NOTO_COLOR_EMOJI_VERSION=$(NOTO_COLOR_EMOJI_VERSION) \
-	--build-arg PDFTK_VERSION=$(PDFTK_VERSION) \
-	--build-arg PDFCPU_VERSION=$(PDFCPU_VERSION) \
+	--target $(TARGET) \
 	-t $(DOCKER_REGISTRY)/$(DOCKER_REPOSITORY):$(GOTENBERG_VERSION) \
 	-f $(DOCKERFILE) $(DOCKER_BUILD_CONTEXT)
 
+TZ=UTC
+GOTENBERG_HIDE_BANNER=false
 GOTENBERG_GRACEFUL_SHUTDOWN_DURATION=30s
+GOTENBERG_BUILD_DEBUG_DATA=true
 API_PORT=3000
 API_PORT_FROM_ENV=
 API_BIND_IP=
 API_START_TIMEOUT=30s
 API_TIMEOUT=30s
 API_BODY_LIMIT=
-API_ROOT_PATH="/"
-API_TRACE_HEADER=Gotenberg-Trace
+API_ROOT_PATH=/
+API_CORRELATION_ID_HEADER=Gotenberg-Trace
 API_ENABLE_BASIC_AUTH=false
 GOTENBERG_API_BASIC_AUTH_USERNAME=
 GOTENBERG_API_BASIC_AUTH_PASSWORD=
-API-DOWNLOAD-FROM-ALLOW-LIST=
-API-DOWNLOAD-FROM-DENY-LIST=
-API-DOWNLOAD-FROM-FROM-MAX-RETRY=4
-API-DISABLE-DOWNLOAD-FROM=false
-API_DISABLE_HEALTH_CHECK_LOGGING=false
+API_DOWNLOAD_FROM_ALLOW_LIST=
+API_DOWNLOAD_FROM_DENY_LIST=^https?://(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.|0\.0\.0\.0|127\.|localhost|\[::1\]|\[fd)
+API_DOWNLOAD_FROM_MAX_RETRY=4
+API_DISABLE_DOWNLOAD_FROM=false
+API_DISABLE_HEALTH_CHECK_ROUTE_TELEMETRY=true
+API_DISABLE_ROOT_ROUTE_TELEMETRY=true
+API_DISABLE_DEBUG_ROUTE_TELEMETRY=true
+API_DISABLE_VERSION_ROUTE_TELEMETRY=true
 API_ENABLE_DEBUG_ROUTE=false
-CHROMIUM_RESTART_AFTER=10
+CHROMIUM_RESTART_AFTER=100
 CHROMIUM_MAX_QUEUE_SIZE=0
+CHROMIUM_IDLE_SHUTDOWN_TIMEOUT=0
+CHROMIUM_MAX_CONCURRENCY=6
 CHROMIUM_AUTO_START=false
 CHROMIUM_START_TIMEOUT=20s
-CHROMIUM_INCOGNITO=false
 CHROMIUM_ALLOW_INSECURE_LOCALHOST=false
 CHROMIUM_IGNORE_CERTIFICATE_ERRORS=false
 CHROMIUM_DISABLE_WEB_SECURITY=false
@@ -54,104 +55,68 @@ CHROMIUM_DISABLE_JAVASCRIPT=false
 CHROMIUM_DISABLE_ROUTES=false
 LIBREOFFICE_RESTART_AFTER=10
 LIBREOFFICE_MAX_QUEUE_SIZE=0
+LIBREOFFICE_IDLE_SHUTDOWN_TIMEOUT=0
 LIBREOFFICE_AUTO_START=false
 LIBREOFFICE_START_TIMEOUT=20s
+LIBREOFFICE_ALLOW_LIST=
+LIBREOFFICE_DENY_LIST=
 LIBREOFFICE_DISABLE_ROUTES=false
 LOG_LEVEL=info
-LOG_FORMAT=auto
 LOG_FIELDS_PREFIX=
-LOG_ENABLE_GCP_FIELDS=false
+LOG_STD_FORMAT=auto
+LOG_STD_ENABLE_GCP_FIELDS=false
+LOG_STD_LEVEL_CASE=lower
+PDFENGINES_DISABLE_ROUTES=false
 PDFENGINES_MERGE_ENGINES=qpdf,pdfcpu,pdftk
 PDFENGINES_SPLIT_ENGINES=pdfcpu,qpdf,pdftk
 PDFENGINES_FLATTEN_ENGINES=qpdf
 PDFENGINES_CONVERT_ENGINES=libreoffice-pdfengine
 PDFENGINES_READ_METADATA_ENGINES=exiftool
 PDFENGINES_WRITE_METADATA_ENGINES=exiftool
-PDFENGINES_DISABLE_ROUTES=false
+PDFENGINES_READ_BOOKMARKS_ENGINES=pdfcpu
+PDFENGINES_WRITE_BOOKMARKS_ENGINES=pdfcpu
+PDFENGINES_WATERMARK_ENGINES=pdfcpu,pdftk
+PDFENGINES_STAMP_ENGINES=pdfcpu,pdftk
+PDFENGINES_ENCRYPT_ENGINES=qpdf,pdfcpu,pdftk
+PDFENGINES_ROTATE_ENGINES=pdfcpu,pdftk
+PDFENGINES_EMBED_ENGINES=qpdf,pdfcpu
+PDFENGINES_EMBED_METADATA_ENGINES=qpdf
+PDFENGINES_FACTUR_X_ENGINES=qpdf
 PROMETHEUS_NAMESPACE=gotenberg
 PROMETHEUS_COLLECT_INTERVAL=1s
-PROMETHEUS_DISABLE_ROUTE_LOGGING=false
+PROMETHEUS_DISABLE_ROUTE_TELEMETRY=true
 PROMETHEUS_DISABLE_COLLECT=false
+PROMETHEUS_METRICS_PATH=/prometheus/metrics
+OTEL_SERVICE_NAME=gotenberg
+OTEL_TRACES_EXPORTER=none
+OTEL_METRICS_EXPORTER=none
+OTEL_LOGS_EXPORTER=none
+OTEL_EXPORTER_OTLP_PROTOCOL=grpc
+OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4317
+OTEL_EXPORTER_OTLP_INSECURE=true
+WEBHOOK_ENABLE_SYNC_MODE=false
 WEBHOOK_ALLOW_LIST=
-WEBHOOK_DENY_LIST=
-WEBHOOK_ERROR_ALLOW_LIST=
-WEBHOOK_ERROR_DENY_LIST=
+WEBHOOK_DENY_LIST=^https?://(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.|0\.0\.0\.0|127\.|localhost|\[::1\]|\[fd)
 WEBHOOK_MAX_RETRY=4
 WEBHOOK_RETRY_MIN_WAIT=1s
 WEBHOOK_RETRY_MAX_WAIT=30s
 WEBHOOK_CLIENT_TIMEOUT=30s
 WEBHOOK_DISABLE=false
 
+# Export all variables so they are available to Compose
+export
+
 .PHONY: run
-run: ## Start a Gotenberg container
-	docker run --rm -it \
-	-p $(API_PORT):$(API_PORT) \
-	-e GOTENBERG_API_BASIC_AUTH_USERNAME=$(GOTENBERG_API_BASIC_AUTH_USERNAME) \
-	-e GOTENBERG_API_BASIC_AUTH_PASSWORD=$(GOTENBERG_API_BASIC_AUTH_PASSWORD) \
-	$(DOCKER_REGISTRY)/$(DOCKER_REPOSITORY):$(GOTENBERG_VERSION) \
-	gotenberg \
-	--gotenberg-graceful-shutdown-duration=$(GOTENBERG_GRACEFUL_SHUTDOWN_DURATION) \
-	--api-port=$(API_PORT) \
-	--api-port-from-env=$(API_PORT_FROM_ENV) \
-	--api-bind-ip=$(API_BIND_IP) \
-	--api-start-timeout=$(API_START_TIMEOUT) \
-	--api-timeout=$(API_TIMEOUT) \
-	--api-body-limit="$(API_BODY_LIMIT)" \
-	--api-root-path=$(API_ROOT_PATH) \
-	--api-trace-header=$(API_TRACE_HEADER) \
-	--api-enable-basic-auth=$(API_ENABLE_BASIC_AUTH) \
-	--api-download-from-allow-list=$(API-DOWNLOAD-FROM-ALLOW-LIST) \
-	--api-download-from-deny-list=$(API-DOWNLOAD-FROM-DENY-LIST) \
-	--api-download-from-max-retry=$(API-DOWNLOAD-FROM-FROM-MAX-RETRY) \
-	--api-disable-download-from=$(API-DISABLE-DOWNLOAD-FROM) \
-	--api-disable-health-check-logging=$(API_DISABLE_HEALTH_CHECK_LOGGING) \
-	--api-enable-debug-route=$(API_ENABLE_DEBUG_ROUTE) \
-	--chromium-restart-after=$(CHROMIUM_RESTART_AFTER) \
-	--chromium-auto-start=$(CHROMIUM_AUTO_START) \
-	--chromium-max-queue-size=$(CHROMIUM_MAX_QUEUE_SIZE) \
-	--chromium-start-timeout=$(CHROMIUM_START_TIMEOUT) \
-	--chromium-incognito=$(CHROMIUM_INCOGNITO) \
-	--chromium-allow-insecure-localhost=$(CHROMIUM_ALLOW_INSECURE_LOCALHOST) \
-	--chromium-ignore-certificate-errors=$(CHROMIUM_IGNORE_CERTIFICATE_ERRORS) \
-	--chromium-disable-web-security=$(CHROMIUM_DISABLE_WEB_SECURITY) \
-	--chromium-allow-file-access-from-files=$(CHROMIUM_ALLOW_FILE_ACCESS_FROM_FILES) \
-	--chromium-host-resolver-rules=$(CHROMIUM_HOST_RESOLVER_RULES) \
-	--chromium-proxy-server=$(CHROMIUM_PROXY_SERVER) \
-	--chromium-allow-list="$(CHROMIUM_ALLOW_LIST)" \
-	--chromium-deny-list="$(CHROMIUM_DENY_LIST)" \
-	--chromium-clear-cache=$(CHROMIUM_CLEAR_CACHE) \
-	--chromium-clear-cookies=$(CHROMIUM_CLEAR_COOKIES) \
-	--chromium-disable-javascript=$(CHROMIUM_DISABLE_JAVASCRIPT) \
-	--chromium-disable-routes=$(CHROMIUM_DISABLE_ROUTES) \
-	--libreoffice-restart-after=$(LIBREOFFICE_RESTART_AFTER) \
-	--libreoffice-max-queue-size=$(LIBREOFFICE_MAX_QUEUE_SIZE) \
-	--libreoffice-auto-start=$(LIBREOFFICE_AUTO_START) \
-	--libreoffice-start-timeout=$(LIBREOFFICE_START_TIMEOUT) \
-	--libreoffice-disable-routes=$(LIBREOFFICE_DISABLE_ROUTES) \
-	--log-level=$(LOG_LEVEL) \
-	--log-format=$(LOG_FORMAT) \
-	--log-fields-prefix=$(LOG_FIELDS_PREFIX) \
-	--log-enable-gcp-fields=$(LOG_ENABLE_GCP_FIELDS) \
-	--pdfengines-merge-engines=$(PDFENGINES_MERGE_ENGINES) \
-	--pdfengines-split-engines=$(PDFENGINES_SPLIT_ENGINES) \
-	--pdfengines-flatten-engines=$(PDFENGINES_FLATTEN_ENGINES) \
-	--pdfengines-convert-engines=$(PDFENGINES_CONVERT_ENGINES) \
-	--pdfengines-read-metadata-engines=$(PDFENGINES_READ_METADATA_ENGINES) \
-	--pdfengines-write-metadata-engines=$(PDFENGINES_WRITE_METADATA_ENGINES) \
-	--pdfengines-disable-routes=$(PDFENGINES_DISABLE_ROUTES) \
-	--prometheus-namespace=$(PROMETHEUS_NAMESPACE) \
-	--prometheus-collect-interval=$(PROMETHEUS_COLLECT_INTERVAL) \
-	--prometheus-disable-route-logging=$(PROMETHEUS_DISABLE_ROUTE_LOGGING) \
-	--prometheus-disable-collect=$(PROMETHEUS_DISABLE_COLLECT) \
-	--webhook-allow-list="$(WEBHOOK_ALLOW_LIST)" \
-	--webhook-deny-list="$(WEBHOOK_DENY_LIST)" \
-	--webhook-error-allow-list=$(WEBHOOK_ERROR_ALLOW_LIST) \
-	--webhook-error-deny-list=$(WEBHOOK_ERROR_DENY_LIST) \
-	--webhook-max-retry=$(WEBHOOK_MAX_RETRY) \
-	--webhook-retry-min-wait=$(WEBHOOK_RETRY_MIN_WAIT) \
-	--webhook-retry-max-wait=$(WEBHOOK_RETRY_MAX_WAIT) \
-	--webhook-client-timeout=$(WEBHOOK_CLIENT_TIMEOUT) \
-	--webhook-disable=$(WEBHOOK_DISABLE)
+run: ## Start a Gotenberg container via Compose
+	docker compose up gotenberg
+
+.PHONY: telemetry
+telemetry: ## Start an OpenTelemetry collector and OpenObserve containers via Compose
+	docker compose up otel-collector openobserve
+
+.PHONY: down
+down: ## Stop all containers
+	docker compose down -v
 
 .PHONY: test-unit
 test-unit: ## Run unit tests
@@ -159,14 +124,58 @@ test-unit: ## Run unit tests
 
 PLATFORM=
 NO_CONCURRENCY=false
+# Available tags:
+# chromium
+# chromium-concurrent
+# chromium-convert-html
+# chromium-convert-markdown
+# chromium-convert-url
+# chromium-screenshot-html
+# chromium-screenshot-markdown
+# chromium-screenshot-url
+# debug
+# health
+# libreoffice
+# libreoffice-convert
+# output-filename
+# pdfengines
+# pdfengines-convert
+# pdfengines-embed
+# embed
+# pdfengines-encrypt
+# encrypt
+# pdfengines-flatten
+# flatten
+# pdfengines-merge
+# merge
+# pdfengines-metadata
+# metadata
+# pdfengines-split
+# split
+# pdfengines-watermark
+# watermark
+# pdfengines-stamp
+# stamp
+# pdfengines-rotate
+# rotate
+# factur-x
+# pdfengines-bookmarks
+# bookmarks
+# prometheus-metrics
+# root
+# version
+# webhook
+# download-from
+TAGS=
 
 .PHONY: test-integration
-test-integration: ## Run integration tests
-	go test -timeout 20m -tags=integration -v github.com/gotenberg/gotenberg/v8/test/integration -args \
+test-integration: ## Run integration tests (automatically retries failed scenarios up to 3 times)
+	go test -timeout 40m -tags=integration -v github.com/gotenberg/gotenberg/v8/test/integration -args \
 	--gotenberg-docker-repository=$(DOCKER_REPOSITORY) \
 	--gotenberg-version=$(GOTENBERG_VERSION) \
  	--gotenberg-container-platform=$(PLATFORM) \
- 	--no-concurrency=$(NO_CONCURRENCY)
+ 	--no-concurrency=$(NO_CONCURRENCY) \
+ 	--tags="$(TAGS)"
 
 .PHONY: lint
 lint: ## Lint Golang codebase
@@ -182,6 +191,7 @@ lint-todo: ## Find TODOs in Golang codebase
 
 .PHONY: fmt
 fmt: ## Format Golang codebase and "optimize" the dependencies
+	go fix ./...
 	golangci-lint fmt
 	go mod tidy
 

README.md

@@ -1,54 +1,72 @@
 <p align="center">
-    <img src="https://user-images.githubusercontent.com/8983173/130322857-185831e2-f041-46eb-a17f-0a69d066c4e5.png" alt="Gotenberg Logo" width="150" height="150" />
+    <img src="https://raw.githubusercontent.com/gotenberg/art/master/logo.png" alt="Gotenberg Logo" width="150" height="150" />
     <h3 align="center">Gotenberg</h3>
-    <p align="center">A containerized API for seamless PDF conversion</p>
+    <p align="center">A Docker-based API for converting documents to PDF</p>
     <p align="center">
         <a href="https://hub.docker.com/r/gotenberg/gotenberg"><img alt="Total downloads (gotenberg/gotenberg)" src="https://img.shields.io/docker/pulls/gotenberg/gotenberg"></a>
-        <a href="https://hub.docker.com/r/thecodingmachine/gotenberg"><img alt="Total downloads (thecodingmachine/gotenberg)" src="https://img.shields.io/docker/pulls/thecodingmachine/gotenberg"></a>
         <a href="https://github.com/gotenberg/gotenberg/actions/workflows/continuous-integration.yml"><img alt="Continuous Integration" src="https://github.com/gotenberg/gotenberg/actions/workflows/continuous-integration.yml/badge.svg"></a>
         <a href="https://pkg.go.dev/github.com/gotenberg/gotenberg/v8"><img alt="Go Reference" src="https://pkg.go.dev/badge/github.com/gotenberg/gotenberg.svg"></a>
     </p>
     <p align="center">
         <a href="https://trendshift.io/repositories/2996"><img src="https://trendshift.io/api/badge/repositories/2996" alt="gotenberg%2Fgotenberg | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a>
     </p>
-    <p align="center"><a href="https://gotenberg.dev/docs/getting-started/introduction">Documentation</a> &#183; <a href="https://gotenberg.dev/docs/getting-started/installation#live-demo-">Live Demo</a> 🔥</p>
+    <p align="center">
+        <a href="https://gotenberg.dev/docs/getting-started/introduction"><strong>Documentation</strong></a> &#183;
+        <a href="https://gotenberg.dev/docs/getting-started/installation#live-demo"><strong>Live Demo</strong></a> &#183;
+        <a href="https://github.com/gotenberg/gotenberg/discussions"><strong>Community</strong></a>
+    </p>
 </p>
 
 ---
 
-**Gotenberg** provides a developer-friendly API to interact with powerful tools like Chromium and LibreOffice for converting
-numerous document formats (HTML, Markdown, Word, Excel, etc.) into PDF files, and more!
+**Gotenberg** is a Docker-based API for converting documents to PDF. Trusted in production by thousands of companies. Also adopted by notable open-source projects.
+
+Send your files via `multipart/form-data`, get a PDF back. No need to manage Chromium, LibreOffice, or fonts yourself.
 
 ## Quick Start
 
-Open a terminal and run the following command:
-
-```
+```bash
 docker run --rm -p 3000:3000 gotenberg/gotenberg:8
 ```
 
-Alternatively, using the historic Docker repository from our sponsor [TheCodingMachine](https://www.thecodingmachine.com):
+Convert a URL to PDF:
 
-```
-docker run --rm -p 3000:3000 thecodingmachine/gotenberg:8
+```bash
+curl \
+  --request POST http://localhost:3000/forms/chromium/convert/url \
+  --form url=https://sparksuite.github.io/simple-html-invoice-template/ \
+  -o invoice.pdf
 ```
 
-The API is now available on your host at http://localhost:3000.
+## Features
 
-Head to the [documentation](https://gotenberg.dev/docs/getting-started/introduction) to learn how to interact with it 🚀
+- **HTML, URL, Markdown to PDF** via Headless Chromium
+- **Office documents to PDF** via LibreOffice (100+ formats)
+- **Merge, split, rotate, flatten** PDFs
+- **Watermark, stamp, encrypt** PDFs
+- **PDF/A and PDF/UA** compliance
+- **Screenshots** of URLs and HTML
+- **Read/write metadata and bookmarks**
+
+See the [full documentation](https://gotenberg.dev/docs/getting-started/introduction).
+
+## Contributing
+
+Questions and feedback: [GitHub Discussions](https://github.com/gotenberg/gotenberg/discussions).
+Bug reports: [GitHub Issues](https://github.com/gotenberg/gotenberg/issues).
 
 ## Sponsors
 
-<p align="center">
-    <a href="https://thecodingmachine.com">
-        <img src="https://user-images.githubusercontent.com/8983173/130324668-9d6e7b35-53a3-49c7-a574-38190d2bd6b0.png" alt="TheCodingMachine Logo" width="333" height="163" />
-    </a>
-    <a href="https://zolsec.com?utm_source=gotenberg_github&utm_medium=website" target="_blank">
-        <img src="https://github.com/gotenberg/gotenberg/assets/8983173/707ccc97-a79b-4dcb-8fc8-6827366e5be3" alt="Zolsec Logo" width="333" height="163" />
-    </a>
-    <a href="https://pdfme.com?utm_source=gotenberg_github&utm_medium=website" target="_blank">
-        <img src="https://github.com/user-attachments/assets/2a75dd40-ca18-4d34-acd5-5dd474595168" alt="pdfme Logo" width="333" height="163" />
-    </a>
-</p>
+If Gotenberg powers your workflow or your business, consider [**becoming a sponsor**](https://github.com/sponsors/gulien).
 
-Sponsorships help maintaining and improving Gotenberg - [become a sponsor](https://github.com/sponsors/gulien) ❤️
+**Historic & GitHub Sponsors**
+
+- [TheCodingMachine](https://thecodingmachine.com/)
+- [pdfme](https://pdfme.com/)
+- [PDFBolt](https://pdfbolt.com)
+- [FileToPDF.dev](https://filetopdf.dev)
+
+**Powered By**
+
+- [Docker](https://docs.docker.com/docker-hub/repos/manage/trusted-content/dsos-program/)
+- [JetBrains](https://www.jetbrains.com/community/opensource/)

SECURITY.md

@@ -2,40 +2,28 @@
 
 ## Supported Versions
 
-Please ensure to keep your environment up-to-date and use only the latest version of Gotenberg.
-Security updates and patches will be applied only to the most recent version.
+Only the latest version receives security updates and patches. Keep your environment up to date.
 
 ## Reporting a Vulnerability
 
-Your help in identifying vulnerabilities in our project is much appreciated.
-We take all reports regarding security seriously.
+Do not publish vulnerabilities publicly. Report them through [GitHub's private vulnerability reporting](https://github.com/gotenberg/gotenberg/security/advisories/new).
 
-If you discover a security vulnerability, please refrain from publishing it publicly.
-Instead, kindly send us the details via email to _neuhart [dot] julien [at] gmail [dot] com_.
-
-In the subject of your email, please indicate that it's a security vulnerability report for Gotenberg.
-In your message, please include:
+Include:
 
 - A detailed description of the vulnerability.
-- The steps to reproduce the issue.
-- Any potential impact of the vulnerability on the users or system.
+- Steps to reproduce the issue.
+- Potential impact on users or the system.
 
-Please remember that this process is done in a _'best-effort'_ manner.
-This means we strive to respond and act as quickly as possible, but the speed may vary depending on the severity of
-the issue and our resources.
-
-Thank you in advance for helping to keep our project safe!
+This process is handled on a best-effort basis. Response speed may vary depending on severity and available resources.
 
 ## Disclosure Policy
 
-Once we have received your vulnerability report, we will work to validate and reproduce the issue.
-If we can confirm the vulnerability, we will proceed to:
+Once a report is received and confirmed:
 
-- Work on a fix and a release timeline.
-- Notify you when the fix has been implemented and released.
-- Credit you for discovering the vulnerability (unless you request anonymity).
-- Please note that we will do our best to keep you informed about the progress towards resolving the issue.
+- A fix and release timeline will be prepared.
+- The reporter will be notified when the fix is released.
+- The reporter will be credited for the discovery (unless anonymity is requested).
 
 ## Comments on this Policy
 
-If you have suggestions on how this process could be improved, please submit a pull request.
+Submit a pull request with suggestions for improving this process.

build/Dockerfile

@@ -1,39 +1,39 @@
 # ARG instructions do not create additional layers. Instead, next layers will
 # concatenate them. Also, we have to repeat ARG instructions in each build
 # stage that uses them.
-ARG GOLANG_VERSION
+ARG GOLANG_VERSION=1.26.2
 
 # ----------------------------------------------
 # pdfcpu binary build stage
 # ----------------------------------------------
 # Note: this stage is required as pdfcpu does not release an armhf variant by
 # default.
-
 FROM golang:$GOLANG_VERSION AS pdfcpu-binary-stage
 
-ARG PDFCPU_VERSION
+# See https://github.com/pdfcpu/pdfcpu/releases.
+ARG PDFCPU_VERSION=v0.12.0
 ENV CGO_ENABLED=0
 
 # Define the working directory outside of $GOPATH (we're using go modules).
 WORKDIR /home
 
-RUN curl -Ls "https://github.com/pdfcpu/pdfcpu/archive/refs/tags/$PDFCPU_VERSION.tar.gz" -o pdfcpu.tar.gz &&\
-    tar --strip-components=1 -xvzf pdfcpu.tar.gz
+RUN curl -Ls "https://github.com/pdfcpu/pdfcpu/archive/refs/tags/$PDFCPU_VERSION.tar.gz" -o pdfcpu.tar.gz \
+    && tar --strip-components=1 -xvzf pdfcpu.tar.gz
 
 # Install module dependencies.
-RUN go mod download &&\
-    go mod verify
+RUN go mod download \
+    && go mod verify
 
-RUN go build -o pdfcpu -ldflags "-s -w -X 'main.version=$PDFCPU_VERSION' -X 'github.com/pdfcpu/pdfcpu/pkg/pdfcpu.VersionStr=$PDFCPU_VERSION' -X main.builtBy=gotenberg" ./cmd/pdfcpu &&\
+RUN go build -o pdfcpu -ldflags "-s -w -X 'main.version=$PDFCPU_VERSION' -X 'github.com/pdfcpu/pdfcpu/pkg/pdfcpu/model.VersionStr=$PDFCPU_VERSION' -X main.builtBy=gotenberg" ./cmd/pdfcpu \
     # Verify installation.
-    ./pdfcpu version
+    && ./pdfcpu version
 
 # ----------------------------------------------
 # Gotenberg binary build stage
 # ----------------------------------------------
 FROM golang:$GOLANG_VERSION AS gotenberg-binary-stage
 
-ARG GOTENBERG_VERSION
+ARG GOTENBERG_VERSION=snapshot
 ENV CGO_ENABLED=0
 
 # Define the working directory outside of $GOPATH (we're using go modules).
@@ -42,185 +42,250 @@ WORKDIR /home
 # Install module dependencies.
 COPY go.mod go.sum ./
 
-RUN go mod download &&\
-    go mod verify
+RUN go mod download \
+    && go mod verify
 
 # Copy the source code.
 COPY cmd ./cmd
 COPY pkg ./pkg
 
-RUN go build -o gotenberg -ldflags "-X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$GOTENBERG_VERSION'" cmd/gotenberg/main.go
+RUN go build -o gotenberg -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$GOTENBERG_VERSION'" cmd/gotenberg/main.go \
+    && go build -o gotenberg-chromium -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$GOTENBERG_VERSION'" cmd/gotenberg-chromium/main.go \
+    && go build -o gotenberg-libreoffice -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$GOTENBERG_VERSION'" cmd/gotenberg-libreoffice/main.go
 
 # ----------------------------------------------
-# Final stage
+# Custom JRE stage
+# Credits: https://github.com/jodconverter/docker-image-jodconverter-runtime
 # ----------------------------------------------
-FROM debian:12-slim
+FROM debian:13-slim AS custom-jre-stage
 
-ARG GOTENBERG_VERSION
-ARG GOTENBERG_USER_GID
-ARG GOTENBERG_USER_UID
-ARG NOTO_COLOR_EMOJI_VERSION
-ARG PDFTK_VERSION
+RUN apt-get update -qq \
+    && apt-get upgrade -yqq \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends default-jdk-headless binutils
 
-LABEL org.opencontainers.image.title="Gotenberg" \
-      org.opencontainers.image.description="A containerized API for seamless PDF conversion." \
-      org.opencontainers.image.version="$GOTENBERG_VERSION" \
-      org.opencontainers.image.authors="Julien Neuhart <neuhart.julien@gmail.com>" \
-      org.opencontainers.image.documentation="https://gotenberg.dev" \
-      org.opencontainers.image.source="https://github.com/gotenberg/gotenberg"
+# Note: jdeps helps finding which modules a JAR requires.
+# Currently only for PDFtk, as we don't rely on LibreOffice UNO Java SDK.
+ENV JAVA_MODULES=java.base,java.desktop,java.naming,java.sql
 
-RUN \
-    # Create a non-root user.
-    # All processes in the Docker container will run with this dedicated user.
-    groupadd --gid "$GOTENBERG_USER_GID" gotenberg &&\
-    useradd --uid "$GOTENBERG_USER_UID" --gid gotenberg --shell /bin/bash --home /home/gotenberg --no-create-home gotenberg &&\
-    mkdir /home/gotenberg &&\
-    chown gotenberg: /home/gotenberg
+RUN jlink \
+    --add-modules $JAVA_MODULES \
+    --strip-debug \
+    --no-man-pages \
+    --no-header-files \
+    --compress=2 \
+    --output /custom-jre
 
-RUN \
-    # Install system dependencies required for the next instructions or debugging.
-    # Note: tini is a helper for reaping zombie processes.
-    apt-get update -qq &&\
-    apt-get upgrade -yqq &&\
-    DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends curl gnupg tini python3 default-jre-headless &&\
-    # Cleanup.
-    # Note: the Debian image does automatically a clean after each install thanks to a hook.
-    # Therefore, there is no need for apt-get clean.
-    # See https://stackoverflow.com/a/24417119/3248473.
-    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+# ----------------------------------------------
+# Downloader stage
+# ----------------------------------------------
+FROM debian:13-slim AS downloader-stage
 
-RUN \
-    # Install fonts.
-    # Credits:
-    # https://github.com/arachnys/athenapdf/blob/master/cli/Dockerfile.
-    # https://help.accusoft.com/PrizmDoc/v12.1/HTML/Installing_Asian_Fonts_on_Ubuntu_and_Debian.html.
-    curl -o ./ttf-mscorefonts-installer_3.8.1_all.deb http://httpredir.debian.org/debian/pool/contrib/m/msttcorefonts/ttf-mscorefonts-installer_3.8.1_all.deb &&\
-    apt-get update -qq &&\
-    apt-get upgrade -yqq &&\
-    DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
-    ./ttf-mscorefonts-installer_3.8.1_all.deb \
-    culmus \
-    fonts-beng \
-    fonts-hosny-amiri \
-    fonts-lklug-sinhala \
-    fonts-lohit-guru \
-    fonts-lohit-knda \
-    fonts-samyak-gujr \
-    fonts-samyak-mlym \
-    fonts-samyak-taml \
-    fonts-sarai \
-    fonts-sil-abyssinica \
-    fonts-sil-padauk \
-    fonts-telu \
-    fonts-thai-tlwg \
-    ttf-wqy-zenhei \
-    fonts-arphic-ukai \
-    fonts-arphic-uming \
-    fonts-ipafont-mincho \
-    fonts-ipafont-gothic \
-    fonts-unfonts-core \
-    # LibreOffice recommends.
-    fonts-crosextra-caladea \
-    fonts-crosextra-carlito \
-    fonts-dejavu \
-    fonts-dejavu-extra \
-    fonts-liberation \
-    fonts-liberation2 \
-    fonts-linuxlibertine \
-    fonts-noto-cjk \
-    fonts-noto-core \
-    fonts-noto-mono \
-    fonts-noto-ui-core \
-    fonts-sil-gentium \
-    fonts-sil-gentium-basic &&\
-    rm -f ./ttf-mscorefonts-installer_3.8.1_all.deb &&\
-    # Add Color and Black-and-White Noto emoji font.
-    # Credits:
-    # https://github.com/gotenberg/gotenberg/pull/325.
-    # https://github.com/googlefonts/noto-emoji.
-    curl -Ls "https://github.com/googlefonts/noto-emoji/raw/$NOTO_COLOR_EMOJI_VERSION/fonts/NotoColorEmoji.ttf" -o /usr/local/share/fonts/NotoColorEmoji.ttf &&\
-    # Cleanup.
-    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+# See https://gitlab.com/pdftk-java/pdftk/-/releases - Binary package.
+ARG PDFTK_VERSION=v3.3.3
 
-RUN \
-    # Install either Google Chrome stable on amd64 architecture or
-    # Chromium on other architectures.
-    # See https://github.com/gotenberg/gotenberg/issues/328.
-    /bin/bash -c \
-    'set -e &&\
-    if [[ "$(dpkg --print-architecture)" == "amd64" ]]; then \
-      curl https://dl.google.com/linux/linux_signing_key.pub | apt-key add - &&\
-      echo "deb http://dl.google.com/linux/chrome/deb/ stable main" | tee /etc/apt/sources.list.d/google-chrome.list &&\
-      apt-get update -qq &&\
-      apt-get upgrade -yqq &&\
-      DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends --allow-unauthenticated google-chrome-stable &&\
-      mv /usr/bin/google-chrome-stable /usr/bin/chromium; \
-    else \
-      apt-get update -qq &&\
-      apt-get upgrade -yqq &&\
-      DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends chromium; \
-    fi' &&\
-    # Verify installation.
-    chromium --version &&\
-    # Cleanup.
-    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+RUN apt-get update -qq \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends curl ca-certificates
 
-RUN \
-    # Install LibreOffice & unoconverter.
-    echo "deb http://deb.debian.org/debian bookworm-backports main" >> /etc/apt/sources.list &&\
-    apt-get update -qq &&\
-    apt-get upgrade -yqq &&\
-    DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends -t bookworm-backports libreoffice &&\
-    curl -Ls https://raw.githubusercontent.com/gotenberg/unoconverter/v0.1.1/unoconv -o /usr/bin/unoconverter &&\
-    chmod +x /usr/bin/unoconverter &&\
-    # unoconverter will look for the Python binary, which has to be at version 3.
-    ln -s /usr/bin/python3 /usr/bin/python &&\
-    # Verify installations.
-    libreoffice --version &&\
-    unoconverter --version &&\
-    # Cleanup.
-    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+WORKDIR /downloads
 
-RUN \
-    # Install PDFtk, QPDF & ExifTool (PDF engines).
-    # See https://github.com/gotenberg/gotenberg/pull/273.
-    curl -o /usr/bin/pdftk-all.jar "https://gitlab.com/api/v4/projects/5024297/packages/generic/pdftk-java/$PDFTK_VERSION/pdftk-all.jar" &&\
-    chmod a+x /usr/bin/pdftk-all.jar &&\
-    echo '#!/bin/bash\n\nexec java -jar /usr/bin/pdftk-all.jar "$@"' > /usr/bin/pdftk && \
-    chmod +x /usr/bin/pdftk &&\
-    apt-get update -qq &&\
-    apt-get upgrade -yqq &&\
-    DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends qpdf exiftool &&\
+RUN curl -Ls https://raw.githubusercontent.com/gotenberg/unoconverter/v0.3.0/unoconv -o unoconverter \
+    && chmod +x unoconverter
+
+RUN curl -o pdftk-all.jar "https://gitlab.com/api/v4/projects/5024297/packages/generic/pdftk-java/$PDFTK_VERSION/pdftk-all.jar" \
+    && chmod a+x pdftk-all.jar
+
+# ----------------------------------------------
+# Base image stage
+# ----------------------------------------------
+FROM debian:13-slim AS base-image-stage
+
+ARG TIMEZONE=UTC
+ENV TZ=$TIMEZONE
+
+COPY --link --from=custom-jre-stage /custom-jre /opt/java
+
+ENV PATH="/opt/java/bin:${PATH}"
+
+# ----------------------------------------------
+# Common stage
+# ----------------------------------------------
+FROM base-image-stage AS common-stage
+
+ARG GOTENBERG_USER_GID=1001
+ARG GOTENBERG_USER_UID=1001
+
+# Create a non-root user.
+# All processes in the Docker container will run with this dedicated user.
+RUN groupadd --gid "$GOTENBERG_USER_GID" gotenberg \
+    && useradd --uid "$GOTENBERG_USER_UID" --gid gotenberg --shell /bin/bash --home /home/gotenberg --no-create-home gotenberg \
+    && mkdir /home/gotenberg \
+    && chown gotenberg: /home/gotenberg
+
+# Note: tini is a helper for reaping zombie processes.
+RUN apt-get update -qq \
+    && apt-get upgrade -yqq \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
+        ca-certificates \
+        tini \
+        # Many users rely on curl for Docker health checks.
+        curl \
+        # Install fonts.
+        # Essential metric-compatible fonts for LibreOffice layout fidelity (replaces MS Fonts).
+        fonts-crosextra-carlito \
+        fonts-crosextra-caladea \
+        fonts-liberation \
+        fonts-liberation2 \
+        # Reliable general-purpose fallback for Chromium.
+        fonts-dejavu \
+        # Unified CJK (Chinese, Japanese, Korean) support.
+        fonts-noto-cjk \
+        # Standard Emoji support.
+        fonts-noto-color-emoji \
+        # Tofu prevention.
+        fonts-noto-core \
+        # Install QPDF & ExifTool (PDF engines).
+        qpdf exiftool \
     # See https://github.com/nextcloud/docker/issues/380.
-    mkdir -p /usr/share/man/man1 &&\
-    # Verify installations.
-    pdftk --version &&\
-    qpdf --version &&\
-    exiftool --version &&\
+    && mkdir -p /usr/share/man/man1 \
     # Cleanup.
-    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+# PDFtk bash wrapper.
+# See https://github.com/gotenberg/gotenberg/pull/273.
+RUN printf '#!/bin/bash\n\nexec java -jar /usr/bin/pdftk-all.jar "$@"' > /usr/bin/pdftk \
+    && chmod +x /usr/bin/pdftk
+
+# Support for arbitrary user IDs (OpenShift).
+# See:
+# https://github.com/gotenberg/gotenberg/issues/1049.
+# https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/images/creating-images#use-uid_create-images.
+RUN usermod -aG root gotenberg \
+    && chgrp -R 0 /home/gotenberg \
+    && chmod -R g=u /home/gotenberg
+
+# COPY instructions last to maximize cache reuse when only source code changes.
 
 # Improve fonts subpixel hinting and smoothing.
 # Credits:
 # https://github.com/arachnys/athenapdf/issues/69.
 # https://github.com/arachnys/athenapdf/commit/ba25a8d80a25d08d58865519c4cd8756dc9a336d.
-COPY build/fonts.conf /etc/fonts/conf.d/100-gotenberg.conf
+COPY --link build/fonts.conf /etc/fonts/conf.d/100-gotenberg.conf
 
-# Copy the pdfcpu binary from the pdfcpu-binary-stage.
-COPY --from=pdfcpu-binary-stage /home/pdfcpu /usr/bin/
+# Copy PDFtk jar.
+COPY --link --from=downloader-stage /downloads/pdftk-all.jar /usr/bin/pdftk-all.jar
 
-# Copy the Gotenberg binary from the gotenberg-binary-stage.
-COPY --from=gotenberg-binary-stage /home/gotenberg /usr/bin/
+# Copy the pdfcpu binary (shared across all variants).
+COPY --link --from=pdfcpu-binary-stage /home/pdfcpu /usr/bin/
 
-# Environment variables required by modules or else.
-ENV CHROMIUM_BIN_PATH=/usr/bin/chromium
-ENV LIBREOFFICE_BIN_PATH=/usr/lib/libreoffice/program/soffice.bin
-ENV UNOCONVERTER_BIN_PATH=/usr/bin/unoconverter
+# Set default characterset encoding to UTF-8.
+# See:
+# https://github.com/gotenberg/gotenberg/issues/104
+# https://github.com/gotenberg/gotenberg/issues/730
+ENV LANG=C.UTF-8
+ENV LC_ALL=C.UTF-8
+
+# Environment variables for PDF engines.
 ENV PDFTK_BIN_PATH=/usr/bin/pdftk
 ENV QPDF_BIN_PATH=/usr/bin/qpdf
 ENV EXIFTOOL_BIN_PATH=/usr/bin/exiftool
 ENV PDFCPU_BIN_PATH=/usr/bin/pdfcpu
 
+# Capture backing-binary versions at build time so the running process reports
+# them on traces without spawning the binaries at startup or per request.
+# See pkg/gotenberg/buildversions.go. Chromium and LibreOffice are captured in
+# the variant stages below, where they are installed.
+ENV GOTENBERG_VERSIONS_DIR_PATH=/opt/gotenberg/versions
+
+COPY --link build/capture-version.sh /opt/gotenberg/capture-version.sh
+
+RUN bash /opt/gotenberg/capture-version.sh "$GOTENBERG_VERSIONS_DIR_PATH" qpdf "$QPDF_BIN_PATH" --version \
+    && bash /opt/gotenberg/capture-version.sh "$GOTENBERG_VERSIONS_DIR_PATH" exiftool "$EXIFTOOL_BIN_PATH" -ver \
+    && bash /opt/gotenberg/capture-version.sh "$GOTENBERG_VERSIONS_DIR_PATH" pdftk "$PDFTK_BIN_PATH" --version \
+    && bash /opt/gotenberg/capture-version.sh "$GOTENBERG_VERSIONS_DIR_PATH" pdfcpu "$PDFCPU_BIN_PATH" version
+
+# OpenTelemetry defaults (noop - no telemetry overhead unless explicitly enabled).
+ENV OTEL_TRACES_EXPORTER=none
+ENV OTEL_METRICS_EXPORTER=none
+ENV OTEL_LOGS_EXPORTER=none
+
+# ----------------------------------------------
+# Final stage: full (Chromium + LibreOffice)
+# ----------------------------------------------
+FROM common-stage AS gotenberg
+
+ARG GOTENBERG_VERSION=snapshot
+ARG GOTENBERG_USER_GID=1001
+ARG GOTENBERG_USER_UID=1001
+ARG TMP_CHROMIUM_VERSION_PPC64EL="146.0.7680.80-1~deb13u1"
+
+LABEL org.opencontainers.image.title="Gotenberg" \
+    org.opencontainers.image.description="A Docker-based API for converting documents to PDF." \
+    org.opencontainers.image.version="$GOTENBERG_VERSION" \
+    org.opencontainers.image.authors="Julien Neuhart <neuhart.julien@gmail.com>" \
+    org.opencontainers.image.documentation="https://gotenberg.dev" \
+    org.opencontainers.image.source="https://github.com/gotenberg/gotenberg"
+
+# Install Chromium.
+# On ppc64el, the latest Chromium is broken, so we pin a known working
+# version from snapshot.debian.org via debsnap.
+RUN /bin/bash -c \
+    'set -e &&\
+    if [[ "$(dpkg --print-architecture)" == "ppc64el" ]]; then \
+      apt-get update -qq &&\
+      DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends devscripts &&\
+      debsnap chromium-common "$TMP_CHROMIUM_VERSION_PPC64EL" -v --force --binary --architecture ppc64el &&\
+      debsnap chromium "$TMP_CHROMIUM_VERSION_PPC64EL" -v --force --binary --architecture ppc64el &&\
+      DEBIAN_FRONTEND=noninteractive apt-get install --fix-broken -y -qq --no-install-recommends "./binary-chromium-common/chromium-common_${TMP_CHROMIUM_VERSION_PPC64EL}_ppc64el.deb" "./binary-chromium/chromium_${TMP_CHROMIUM_VERSION_PPC64EL}_ppc64el.deb" &&\
+      DEBIAN_FRONTEND=noninteractive apt-get purge -y -qq devscripts &&\
+      rm -rf ./binary-chromium-common/* ./binary-chromium/*; \
+    else \
+      apt-get update -qq &&\
+      apt-get upgrade -yqq &&\
+      DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends chromium; \
+    fi' \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+# Install LibreOffice & unoconverter.
+RUN echo "deb http://deb.debian.org/debian trixie-backports main" >> /etc/apt/sources.list \
+    && apt-get update -qq \
+    && apt-get upgrade -yqq \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
+        python3 python3-distutils-extra \
+        # Install Hyphenation for LibreOffice.
+        # Credits: https://wiki.archlinux.org/title/LibreOffice.
+        hyphen-af hyphen-as hyphen-be hyphen-bg hyphen-bn hyphen-ca hyphen-cs hyphen-da hyphen-de hyphen-el \
+        hyphen-en-gb hyphen-en-us hyphen-eo hyphen-es hyphen-fr hyphen-gl hyphen-gu hyphen-hi hyphen-hr hyphen-hu \
+        hyphen-id hyphen-is hyphen-it hyphen-kn hyphen-lt hyphen-lv hyphen-ml hyphen-mn hyphen-mr hyphen-nl \
+        hyphen-no hyphen-or hyphen-pa hyphen-pl hyphen-pt-br hyphen-pt-pt hyphen-ro hyphen-ru hyphen-sk hyphen-sl \
+        hyphen-sr hyphen-sv hyphen-ta hyphen-te hyphen-th hyphen-uk hyphen-zu \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends -t trixie-backports \
+        libreoffice-writer libreoffice-calc libreoffice-impress libreoffice-draw python3-uno \
+    # unoconverter will look for the Python binary, which has to be at version 3.
+    && ln -s /usr/bin/python3 /usr/bin/python \
+    # Cleanup.
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+# COPY instructions last to maximize cache reuse.
+
+# Copy the Gotenberg binary (full variant with all modules).
+COPY --link --from=gotenberg-binary-stage /home/gotenberg /usr/bin/
+
+# Copy unoconverter.
+COPY --link --from=downloader-stage /downloads/unoconverter /usr/bin/unoconverter
+
+# Copy dictionnaries so that hyphens work on Chromium.
+# See https://github.com/gotenberg/gotenberg/issues/1293.
+COPY --link --chown="$GOTENBERG_USER_UID:$GOTENBERG_USER_GID" build/chromium-hyphen-data /opt/gotenberg/chromium-hyphen-data
+
+ENV CHROMIUM_BIN_PATH=/usr/bin/chromium
+ENV CHROMIUM_HYPHEN_DATA_DIR_PATH=/opt/gotenberg/chromium-hyphen-data
+ENV LIBREOFFICE_BIN_PATH=/usr/lib/libreoffice/program/soffice.bin
+ENV UNOCONVERTER_BIN_PATH=/usr/bin/unoconverter
+
+# Capture Chromium and LibreOffice versions now that both are installed.
+RUN bash /opt/gotenberg/capture-version.sh "$GOTENBERG_VERSIONS_DIR_PATH" chromium "$CHROMIUM_BIN_PATH" --version \
+    && bash /opt/gotenberg/capture-version.sh "$GOTENBERG_VERSIONS_DIR_PATH" libreoffice-api "$LIBREOFFICE_BIN_PATH" --version
+
 USER gotenberg
 WORKDIR /home/gotenberg
 
@@ -229,3 +294,240 @@ EXPOSE 3000
 
 ENTRYPOINT [ "/usr/bin/tini", "--" ]
 CMD [ "gotenberg" ]
+
+# ----------------------------------------------
+# Final stage: Chromium only
+# ----------------------------------------------
+FROM common-stage AS gotenberg-chromium
+
+ARG GOTENBERG_VERSION=snapshot
+ARG GOTENBERG_USER_GID=1001
+ARG GOTENBERG_USER_UID=1001
+ARG TMP_CHROMIUM_VERSION_PPC64EL="146.0.7680.80-1~deb13u1"
+
+LABEL org.opencontainers.image.title="Gotenberg (Chromium)" \
+    org.opencontainers.image.description="A Docker-based API for converting documents to PDF — Chromium variant." \
+    org.opencontainers.image.version="$GOTENBERG_VERSION" \
+    org.opencontainers.image.authors="Julien Neuhart <neuhart.julien@gmail.com>" \
+    org.opencontainers.image.documentation="https://gotenberg.dev" \
+    org.opencontainers.image.source="https://github.com/gotenberg/gotenberg"
+
+# Install Chromium.
+# On ppc64el, the latest Chromium is broken, so we pin a known working
+# version from snapshot.debian.org via debsnap.
+RUN /bin/bash -c \
+    'set -e &&\
+    if [[ "$(dpkg --print-architecture)" == "ppc64el" ]]; then \
+      apt-get update -qq &&\
+      DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends devscripts &&\
+      debsnap chromium-common "$TMP_CHROMIUM_VERSION_PPC64EL" -v --force --binary --architecture ppc64el &&\
+      debsnap chromium "$TMP_CHROMIUM_VERSION_PPC64EL" -v --force --binary --architecture ppc64el &&\
+      DEBIAN_FRONTEND=noninteractive apt-get install --fix-broken -y -qq --no-install-recommends "./binary-chromium-common/chromium-common_${TMP_CHROMIUM_VERSION_PPC64EL}_ppc64el.deb" "./binary-chromium/chromium_${TMP_CHROMIUM_VERSION_PPC64EL}_ppc64el.deb" &&\
+      DEBIAN_FRONTEND=noninteractive apt-get purge -y -qq devscripts &&\
+      rm -rf ./binary-chromium-common/* ./binary-chromium/*; \
+    else \
+      apt-get update -qq &&\
+      apt-get upgrade -yqq &&\
+      DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends chromium; \
+    fi' \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+# COPY instructions last to maximize cache reuse.
+
+# Copy the Gotenberg binary (Chromium variant, no LibreOffice modules).
+COPY --link --from=gotenberg-binary-stage /home/gotenberg-chromium /usr/bin/gotenberg
+
+# Copy dictionnaries so that hyphens work on Chromium.
+# See https://github.com/gotenberg/gotenberg/issues/1293.
+COPY --link --chown="$GOTENBERG_USER_UID:$GOTENBERG_USER_GID" build/chromium-hyphen-data /opt/gotenberg/chromium-hyphen-data
+
+ENV CHROMIUM_BIN_PATH=/usr/bin/chromium
+ENV CHROMIUM_HYPHEN_DATA_DIR_PATH=/opt/gotenberg/chromium-hyphen-data
+# No LibreOffice in this variant; override the default to use all available engines.
+ENV PDFENGINES_CONVERT_ENGINES=
+
+# Capture the Chromium version now that it is installed.
+RUN bash /opt/gotenberg/capture-version.sh "$GOTENBERG_VERSIONS_DIR_PATH" chromium "$CHROMIUM_BIN_PATH" --version
+
+USER gotenberg
+WORKDIR /home/gotenberg
+
+# Default API port.
+EXPOSE 3000
+
+ENTRYPOINT [ "/usr/bin/tini", "--" ]
+CMD [ "gotenberg" ]
+
+# ----------------------------------------------
+# Final stage: LibreOffice only
+# ----------------------------------------------
+FROM common-stage AS gotenberg-libreoffice
+
+ARG GOTENBERG_VERSION=snapshot
+
+LABEL org.opencontainers.image.title="Gotenberg (LibreOffice)" \
+    org.opencontainers.image.description="A Docker-based API for converting documents to PDF — LibreOffice variant." \
+    org.opencontainers.image.version="$GOTENBERG_VERSION" \
+    org.opencontainers.image.authors="Julien Neuhart <neuhart.julien@gmail.com>" \
+    org.opencontainers.image.documentation="https://gotenberg.dev" \
+    org.opencontainers.image.source="https://github.com/gotenberg/gotenberg"
+
+# Install LibreOffice & unoconverter.
+RUN echo "deb http://deb.debian.org/debian trixie-backports main" >> /etc/apt/sources.list \
+    && apt-get update -qq \
+    && apt-get upgrade -yqq \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
+        python3 python3-distutils-extra \
+        # Install Hyphenation for LibreOffice.
+        # Credits: https://wiki.archlinux.org/title/LibreOffice.
+        hyphen-af hyphen-as hyphen-be hyphen-bg hyphen-bn hyphen-ca hyphen-cs hyphen-da hyphen-de hyphen-el \
+        hyphen-en-gb hyphen-en-us hyphen-eo hyphen-es hyphen-fr hyphen-gl hyphen-gu hyphen-hi hyphen-hr hyphen-hu \
+        hyphen-id hyphen-is hyphen-it hyphen-kn hyphen-lt hyphen-lv hyphen-ml hyphen-mn hyphen-mr hyphen-nl \
+        hyphen-no hyphen-or hyphen-pa hyphen-pl hyphen-pt-br hyphen-pt-pt hyphen-ro hyphen-ru hyphen-sk hyphen-sl \
+        hyphen-sr hyphen-sv hyphen-ta hyphen-te hyphen-th hyphen-uk hyphen-zu \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends -t trixie-backports \
+        libreoffice-writer libreoffice-calc libreoffice-impress libreoffice-draw python3-uno \
+    # unoconverter will look for the Python binary, which has to be at version 3.
+    && ln -s /usr/bin/python3 /usr/bin/python \
+    # Cleanup.
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+# COPY instructions last to maximize cache reuse.
+
+# Copy the Gotenberg binary (LibreOffice variant, no Chromium modules).
+COPY --link --from=gotenberg-binary-stage /home/gotenberg-libreoffice /usr/bin/gotenberg
+
+# Copy unoconverter.
+COPY --link --from=downloader-stage /downloads/unoconverter /usr/bin/unoconverter
+
+ENV LIBREOFFICE_BIN_PATH=/usr/lib/libreoffice/program/soffice.bin
+ENV UNOCONVERTER_BIN_PATH=/usr/bin/unoconverter
+
+# Capture the LibreOffice version now that it is installed.
+RUN bash /opt/gotenberg/capture-version.sh "$GOTENBERG_VERSIONS_DIR_PATH" libreoffice-api "$LIBREOFFICE_BIN_PATH" --version
+
+USER gotenberg
+WORKDIR /home/gotenberg
+
+# Default API port.
+EXPOSE 3000
+
+ENTRYPOINT [ "/usr/bin/tini", "--" ]
+CMD [ "gotenberg" ]
+
+# ==============================================================
+# Cloud Run variants
+# ==============================================================
+
+# ----------------------------------------------
+# Cloud Run: full (Chromium + LibreOffice)
+# ----------------------------------------------
+FROM gotenberg AS gotenberg-cloudrun
+
+USER root
+
+# For security reasons, the non-root user gotenberg does not own the Tini binary by default.
+# However, some providers like Cloud Run from Google Cloud cannot start a Docker container in that case.
+# See https://github.com/gotenberg/gotenberg/issues/90#issuecomment-543551353.
+RUN chown gotenberg: /usr/bin/tini
+
+ENV API_PORT_FROM_ENV=PORT
+ENV CHROMIUM_AUTO_START=true
+ENV LIBREOFFICE_AUTO_START=true
+ENV WEBHOOK_ENABLE_SYNC_MODE=true
+ENV GOTENBERG_BUILD_DEBUG_DATA=false
+ENV LOG_STD_ENABLE_GCP_FIELDS=true
+
+USER gotenberg
+
+# ----------------------------------------------
+# Cloud Run: Chromium only
+# ----------------------------------------------
+FROM gotenberg-chromium AS gotenberg-cloudrun-chromium
+
+USER root
+
+RUN chown gotenberg: /usr/bin/tini
+
+ENV API_PORT_FROM_ENV=PORT
+ENV CHROMIUM_AUTO_START=true
+ENV WEBHOOK_ENABLE_SYNC_MODE=true
+ENV GOTENBERG_BUILD_DEBUG_DATA=false
+ENV LOG_STD_ENABLE_GCP_FIELDS=true
+
+USER gotenberg
+
+# ----------------------------------------------
+# Cloud Run: LibreOffice only
+# ----------------------------------------------
+FROM gotenberg-libreoffice AS gotenberg-cloudrun-libreoffice
+
+USER root
+
+RUN chown gotenberg: /usr/bin/tini
+
+ENV API_PORT_FROM_ENV=PORT
+ENV LIBREOFFICE_AUTO_START=true
+ENV WEBHOOK_ENABLE_SYNC_MODE=true
+ENV GOTENBERG_BUILD_DEBUG_DATA=false
+ENV LOG_STD_ENABLE_GCP_FIELDS=true
+
+USER gotenberg
+
+# ==============================================================
+# AWS Lambda variants
+# ==============================================================
+
+# ----------------------------------------------
+# AWS Lambda: full (Chromium + LibreOffice)
+# ----------------------------------------------
+FROM gotenberg AS gotenberg-aws-lambda
+
+USER root
+
+COPY --from=public.ecr.aws/awsguru/aws-lambda-adapter:0.9.1 /lambda-adapter /opt/extensions/lambda-adapter
+
+ENV AWS_LWA_PORT=3000
+ENV AWS_LWA_READINESS_CHECK_PATH=/health
+ENV AWS_LWA_INVOKE_MODE=buffered
+ENV API_PORT_FROM_ENV=AWS_LWA_PORT
+ENV WEBHOOK_ENABLE_SYNC_MODE=true
+ENV GOTENBERG_BUILD_DEBUG_DATA=false
+
+USER gotenberg
+
+# ----------------------------------------------
+# AWS Lambda: Chromium only
+# ----------------------------------------------
+FROM gotenberg-chromium AS gotenberg-aws-lambda-chromium
+
+USER root
+
+COPY --from=public.ecr.aws/awsguru/aws-lambda-adapter:0.9.1 /lambda-adapter /opt/extensions/lambda-adapter
+
+ENV AWS_LWA_PORT=3000
+ENV AWS_LWA_READINESS_CHECK_PATH=/health
+ENV AWS_LWA_INVOKE_MODE=buffered
+ENV API_PORT_FROM_ENV=AWS_LWA_PORT
+ENV WEBHOOK_ENABLE_SYNC_MODE=true
+ENV GOTENBERG_BUILD_DEBUG_DATA=false
+
+USER gotenberg
+
+# ----------------------------------------------
+# AWS Lambda: LibreOffice only
+# ----------------------------------------------
+FROM gotenberg-libreoffice AS gotenberg-aws-lambda-libreoffice
+
+USER root
+
+COPY --from=public.ecr.aws/awsguru/aws-lambda-adapter:0.9.1 /lambda-adapter /opt/extensions/lambda-adapter
+
+ENV AWS_LWA_PORT=3000
+ENV AWS_LWA_READINESS_CHECK_PATH=/health
+ENV AWS_LWA_INVOKE_MODE=buffered
+ENV API_PORT_FROM_ENV=AWS_LWA_PORT
+ENV WEBHOOK_ENABLE_SYNC_MODE=true
+ENV GOTENBERG_BUILD_DEBUG_DATA=false
+
+USER gotenberg

build/Dockerfile.cloudrun

@@ -1,14 +0,0 @@
-ARG DOCKER_REGISTRY
-ARG DOCKER_REPOSITORY
-ARG GOTENBERG_VERSION
-
-FROM $DOCKER_REGISTRY/$DOCKER_REPOSITORY:$GOTENBERG_VERSION
-
-USER root
-
-# For security reasons, the non-root user gotenberg does not own the Tini binary by default.
-# However, some providers like Cloud Run from Google Cloud cannot start a Docker container in that case.
-# See https://github.com/gotenberg/gotenberg/issues/90#issuecomment-543551353.
-RUN chown gotenberg: /usr/bin/tini
-
-USER gotenberg

build/capture-version.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Captures the version of a backing binary into a per-module file that the
+# running Gotenberg process reads via gotenberg.BuildVersion, so it never spawns
+# the binary just to report a version. This keeps cold start and the first
+# request cheap, which matters on serverless platforms.
+#
+# Failure-tolerant by design: a probe that errors writes an empty file, and the
+# runtime falls back to detecting the version live. A failing probe must never
+# fail the image build.
+#
+# Usage: capture-version.sh <output-dir> <module-id> <bin> [args...]
+set -u
+
+dir="$1"
+id="$2"
+shift 2
+
+mkdir -p "$dir"
+
+# Run the probe once. On failure, keep going with empty output.
+raw="$("$@" 2>/dev/null)" || raw=""
+
+case "$id" in
+pdfcpu)
+    # pdfcpu prints "pdfcpu: <version>"; keep only the part the runtime parser
+    # keeps so the recorded value matches the live-detection fallback.
+    version="$(printf '%s\n' "$raw" | grep -m1 '^pdfcpu:' | sed 's/^pdfcpu:[[:space:]]*//')"
+    ;;
+*)
+    version="$(printf '%s\n' "$raw" | head -n1)"
+    ;;
+esac
+
+printf '%s' "$version" | tr -d '\r' >"$dir/$id"