Limit what image processing workers can reach
Review converter formats, filesystem access, credentials, and resource limits. Verify the worker's actual restrictions with harmless boundary tests.
An image converter parses complex input on behalf of an uploader. Keep its authority smaller than the web application's authority. A separate process is useful only when its filesystem, network, credentials, and resource access are actually constrained.
ImageMagick documents security policies for formats and resource limits. The worker boundary below is a suggested review artifact. Use the equivalent controls for your selected converter and verify the effective configuration of the deployed version.
Specify the worker's minimum environment
List accepted input formats and required output formats. Remove unnecessary external delegates and conversion capabilities. Provide only the assigned input and a dedicated output directory, rather than mounting the entire application checkout or shared upload store.
| Capability | Expected boundary | Verification evidence |
|---|---|---|
| Filesystem read | Assigned input and required runtime files | Unrelated test file is unavailable |
| Filesystem write | Job-specific scratch output | Outside write is denied |
| Network | None unless a documented feature needs it | Controlled connection cannot leave the boundary |
| Credentials | No production service secrets | Environment and mounted-secret inventory |
| Resources | Defined time, memory, pixels, and disk | Bounded limit failure |
Do not infer the absence of credentials from an empty environment alone. Check mounted configuration, instance identity, and inherited process access.
Exercise failure without harmful inputs
Use generated benign images and reduced test limits. Verify oversized dimensions, too many frames, cancellation, and an unsupported format. Observe the supervisor's behavior when a process exceeds its budget. It should end the job and retain a controlled failure record.
Check temporary files after each failure. A process termination is incomplete cleanup if private inputs remain in a shared scratch directory or a partial output becomes downloadable. Keep job identities separate so one tenant's failed conversion cannot overwrite another job's result.
Bind the output to the checked job
Validate the resulting format and expected dimensions before publication. Record the input identity, converter version, policy version, and output identity together. A successful process exit alone should not authorize serving any file it happened to create.
Retest effective restrictions after changing the container image or conversion command. Keep supported-image success cases beside the denial tests. The review is complete when the team can show both the intended transformation and the restricted reach of the process that performed it, without claiming that a container name or policy file alone proves isolation.
Find the gaps before your next launch
Use the release checklist to identify changed security boundaries and missing evidence. Discuss the application paths you want reviewed before launch.
Sources
- ImageMagick: Security PolicyAccessed