Initial commit of new flow

docker/latex/Dockerfile

@@ -0,0 +1,28 @@
+FROM pandoc/latex:2.18.0.0 AS basic
+
+RUN apk add --no-cache texlive=20210325-r4
+
+# texlive is huuuge and we don't want to keep re-downloading it; don't warn on the repeated RUN command
+# hadolint ignore=DL3059
+RUN tlmgr update --self && \
+    tlmgr install tikz-cd && \
+    tlmgr install mdframed && \
+    tlmgr install mathtools && \
+    # Dependencies of mdframed \
+    tlmgr install zref && \
+    tlmgr install needspace
+
+FROM basic AS build
+
+COPY "build.sh" "/build.sh"
+
+RUN mkdir /sentinels && \
+    chmod a+rwx /sentinels && \
+    chmod +x /build.sh && \
+    addgroup -S pdftex && adduser -S pdftex -G pdftex
+
+USER pdftex
+
+WORKDIR /home/pdftex
+
+ENTRYPOINT []

docker/latex/build.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+
+USER_DIR=$(readlink -f "$1")
+WORKDIR=$(mktemp -d -p "$USER_DIR")
+
+cd "$WORKDIR" || exit 1
+
+SHELL="/bin/sh"
+
+# Build PDFs from LaTeX. Do the build twice to sort out any bookmarks.
+# For some reason, using $0 instead of `sh` makes Hadolint warn about the single-quotes not expanding expressions
+# shellcheck disable=SC2016
+find "$USER_DIR" -type f -name '*.tex' -exec "$SHELL" -c '
+  if [ -f "${@%.*}.pdf" ]; then exit 0; fi;
+  output=$(dirname "$@")/$(basename "$@" .tex).pdf
+  echo "$@ - $output"
+  HOME=$(pwd) SOURCE_DATE_EPOCH=1622905527 pdflatex "$@" || exit 1
+  HOME=$(pwd) SOURCE_DATE_EPOCH=1622905527 pdflatex "$@" || exit 1
+  mv "$(basename "$output")" "$output" || exit 1
+' -- {} \; || exit 1
+
+cd "$USER_DIR" || exit 1
+rm -r "$WORKDIR"