wkhtmltopdf today · Install

wkhtmltopdf in Docker

Debian 13 has no wkhtmltopdf package, neither wkhtmltopdf’s nor its own: an image built on debian:13, or on a language image based on it, cannot install it. pdfkiln publishes ghcr.io/jamalofski/pdfkiln, for amd64 and arm64.

Convert

curl -fsSO https://raw.githubusercontent.com/Jamalofski/pdfkiln/main/docker/seccomp.json
docker run --rm -i --security-opt seccomp=seccomp.json ghcr.io/jamalofski/pdfkiln wkhtmltopdf - - < page.html > page.pdf

Debian 13 slim with the pdfkiln Debian package, run as an unprivileged user. The entry point is pdfkiln; wkhtmltopdf or wkhtmltoimage as first argument switches to the compatible mode.

Why a seccomp profile

Docker’s default profile allows clone and unshare only without namespace flags, which stops Chromium’s sandbox. seccomp.json is that profile, plus clone and unshare for the user, PID and network namespaces the sandbox creates; mount, cgroup, UTS and IPC stay refused. CI checks it.

--security-opt seccomp=unconfined and --cap-add SYS_ADMIN also start the sandbox, but are not recommended: the first drops the whole filter, the second helps escape a container. --security-opt apparmor=unconfined does not help.

Fonts

The image holds the Liberation and DejaVu fonts. Templates that need others get them from a derived image:

FROM ghcr.io/jamalofski/pdfkiln
USER root
RUN apt-get update && apt-get install -y --no-install-recommends fonts-noto-core \
 && rm -rf /var/lib/apt/lists/*
USER pdfkiln