feat: extract OCR worker into separate service

- Remove Python/OCR steps from backend.Dockerfile (builder + runtime)
- Remove Python/OCR steps from backend-dev.Dockerfile
- Add OCR_BASE_URL env var to both Dockerfiles (http://ocr-worker:8100)
- Add ocr-worker service to docker-compose.yml with healthcheck
- Add ocr-worker service to docker-compose.dev.yml with healthcheck + port
- Update backend depends_on in both compose files to include ocr-worker
- Replace OCR_PROJECT_ROOT with OCR_BASE_URL in compose env vars
- Remove pip install line from start-dev-container.sh

apps/backend/scripts/start-dev-container.sh

@@ -85,7 +85,6 @@ start_browser_debug_services() {
 }
 
 npm install --no-fund --no-audit
-python3 -m pip install --no-cache-dir --break-system-packages -e /app/subservices/ocr-worker
 
 if ! is_true "${TENCENT_BROWSER_HEADLESS:-true}"; then
   start_browser_debug_services

deploy/docker/backend-dev.Dockerfile

@@ -1,15 +1,14 @@
-# Dev Dockerfile — single-stage, root, VNC/X11 + Playwright + OCR
+# Dev Dockerfile — single-stage, root, VNC/X11 + Playwright
 # For production, see backend.Dockerfile (multi-stage build)
 FROM node:22-bookworm
 
 ARG DEBIAN_MIRROR=mirrors.cloud.tencent.com
 ARG NPM_REGISTRY=https://registry.npmmirror.com
-ARG UV_INDEX_URL=https://mirrors.cloud.tencent.com/pypi/simple
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV TZ=Asia/Shanghai
 ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright
-ENV PIP_INDEX_URL=${UV_INDEX_URL}
+ENV OCR_BASE_URL=http://ocr-worker:8100
 ENV NPM_CONFIG_REGISTRY=${NPM_REGISTRY}
 
 WORKDIR /app
@@ -20,7 +19,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
   && sed -i "s|http://security.debian.org/debian-security|http://${DEBIAN_MIRROR}/debian-security|g" /etc/apt/sources.list.d/debian.sources \
   && apt-get update \
   && apt-get install -y --no-install-recommends \
-       curl ca-certificates python3 python3-pip tzdata \
+       curl ca-certificates tzdata \
        xauth x11vnc novnc websockify xvfb \
   && ln -snf /usr/share/zoneinfo/${TZ} /etc/localtime \
   && echo ${TZ} > /etc/timezone
@@ -34,10 +33,6 @@ RUN --mount=type=cache,target=/ms-playwright-cache,sharing=locked \
     npx playwright install --with-deps chromium \
   && cp -r /ms-playwright-cache /ms-playwright
 
-COPY apps/backend/subservices/ocr-worker/ ./subservices/ocr-worker/
-RUN --mount=type=cache,target=/root/.cache/pip,sharing=locked \
-    python3 -m pip install --break-system-packages ./subservices/ocr-worker
-
 COPY apps/backend/ ./
 
 RUN mkdir -p /app/data /app/data/browser-sessions /app/data/redeem-screenshots

deploy/docker/backend.Dockerfile

@@ -11,12 +11,10 @@ FROM node:22-bookworm AS builder
 
 ARG DEBIAN_MIRROR=mirrors.cloud.tencent.com
 ARG NPM_REGISTRY=https://registry.npmmirror.com
-ARG UV_INDEX_URL=https://mirrors.cloud.tencent.com/pypi/simple
 
 # NOTE: Use HTTP (not HTTPS) for apt mirrors — OrbStack BuildKit cannot verify
 # TLS certs during build.  Apt packages are GPG-signed so HTTP is safe.
 ENV DEBIAN_FRONTEND=noninteractive
-ENV PIP_INDEX_URL=${UV_INDEX_URL}
 ENV NPM_CONFIG_REGISTRY=${NPM_REGISTRY}
 
 WORKDIR /app
@@ -28,7 +26,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
   && sed -i "s|http://security.debian.org/debian-security|http://${DEBIAN_MIRROR}/debian-security|g" /etc/apt/sources.list.d/debian.sources \
   && apt-get update \
   && apt-get install -y --no-install-recommends \
-       python3 python3-pip python3-venv curl ca-certificates tzdata
+       curl ca-certificates tzdata
 
 # --- Node dependencies (full, including devDeps for postinstall scripts) ---
 COPY apps/backend/package.json apps/backend/package-lock.json ./
@@ -46,34 +44,24 @@ RUN --mount=type=cache,target=/ms-playwright-cache,sharing=locked \
     npx playwright install --with-deps chromium \
   && cp -r /ms-playwright-cache /ms-playwright
 
-# --- Python venv for OCR worker ---
-# Use a virtual environment instead of --break-system-packages
-COPY apps/backend/subservices/ocr-worker/ ./subservices/ocr-worker/
-RUN python3 -m venv /app/subservices/ocr-worker/.venv \
-  && /app/subservices/ocr-worker/.venv/bin/pip install --no-cache-dir -U pip \
-  && /app/subservices/ocr-worker/.venv/bin/pip install --no-cache-dir ./subservices/ocr-worker
-
 # --- Copy application source ---
 COPY apps/backend/ ./
 
 # --------------------------- Runtime Stage -----------------------------------
 FROM node:22-bookworm-slim AS runtime
 
-ARG DEBIAN_MIRROR=mirrors.cloud.tencent.com
-
 # HTTP mirrors — see builder note about OrbStack TLS
 ENV DEBIAN_FRONTEND=noninteractive
 ENV TZ=Asia/Shanghai
 ENV NODE_ENV=production
 ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright
-ENV OCR_PROJECT_ROOT=/app/subservices/ocr-worker
+ENV OCR_BASE_URL=http://ocr-worker:8100
 
 WORKDIR /app
 
 # --- Minimal runtime apt packages ---
 # - curl: health check (docker-compose uses `curl -fsS http://127.0.0.1:3000/health/ready`)
 # - ca-certificates: TLS for outbound HTTPS calls
-# - python3: needed by venv (links to system libpython)
 # - tzdata: timezone data for TZ=Asia/Shanghai
 # - Chromium runtime libs: minimal set for headless Chromium on slim
 #
@@ -86,7 +74,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     apt-get update \
   && apt-get install -y --no-install-recommends \
-       curl ca-certificates python3 tzdata \
+       curl ca-certificates tzdata \
        libnss3 libnspr4 libdbus-1-3 libatk1.0-0 libatk-bridge2.0-0 \
        libcups2 libdrm2 libxkbcommon0 libatspi2.0-0 libxcomposite1 \
        libxdamage1 libxfixes3 libxrandr2 libgbm1 libpango-1.0-0 \
@@ -105,10 +93,6 @@ COPY --from=builder /app/src ./src
 COPY --from=builder /app/config ./config
 # Playwright browsers
 COPY --from=builder /ms-playwright /ms-playwright
-# Python venv for OCR worker (located at .venv inside subservices/ocr-worker)
-COPY --from=builder /app/subservices/ocr-worker/.venv ./subservices/ocr-worker/.venv
-COPY --from=builder /app/subservices/ocr-worker/src ./subservices/ocr-worker/src
-COPY --from=builder /app/subservices/ocr-worker/pyproject.toml ./subservices/ocr-worker/pyproject.toml
 
 # --- Non-root user for security ---
 RUN groupadd -g 1001 appuser \

docker-compose.dev.yml

@@ -21,6 +21,22 @@ services:
     volumes:
       - postgres_dev_data:/var/lib/postgresql/data
 
+  ocr-worker:
+    build:
+      context: .
+      dockerfile: deploy/docker/ocr-worker.Dockerfile
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8100/health || exit 1"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+      start_period: 15s
+    environment:
+      TZ: ${TZ:-Asia/Shanghai}
+    ports:
+      - "${OCR_PORT:-8100}:8100"
+
   backend:
     build:
       context: .
@@ -33,6 +49,8 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
+      ocr-worker:
+        condition: service_healthy
     healthcheck:
       test:
         ["CMD-SHELL", "curl -fsS http://127.0.0.1:3000/health/ready || exit 1"]
@@ -46,7 +64,7 @@ services:
       DATABASE_URL: ${DATABASE_URL:-postgres://postgres:postgres@postgres:5432/order_site}
       DATABASE_SSL: ${DATABASE_SSL:-false}
       DATABASE_MAX_CONNECTIONS: ${DATABASE_MAX_CONNECTIONS:-10}
-      OCR_PROJECT_ROOT: /app/subservices/ocr-worker
+      OCR_BASE_URL: http://ocr-worker:8100
       CLAIM_BASE_URL: ${CLAIM_BASE_URL:-http://localhost/#/claim}
       TENCENT_REDEEM_PROOF_MODE: ${TENCENT_REDEEM_PROOF_MODE:-full}
       TENCENT_BROWSER_HEADLESS: ${TENCENT_BROWSER_HEADLESS:-true}

docker-compose.yml

@@ -15,6 +15,20 @@ services:
     volumes:
       - postgres_data:/var/lib/postgresql/data
 
+  ocr-worker:
+    build:
+      context: .
+      dockerfile: deploy/docker/ocr-worker.Dockerfile
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8100/health || exit 1"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+      start_period: 15s
+    environment:
+      TZ: ${TZ:-Asia/Shanghai}
+
   backend:
     build:
       context: .
@@ -25,6 +39,8 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
+      ocr-worker:
+        condition: service_healthy
     healthcheck:
       test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:3000/health/ready || exit 1"]
       interval: 5s
@@ -37,7 +53,7 @@ services:
       DATABASE_URL: ${DATABASE_URL:-postgres://postgres:postgres@postgres:5432/order_site}
       DATABASE_SSL: ${DATABASE_SSL:-false}
       DATABASE_MAX_CONNECTIONS: ${DATABASE_MAX_CONNECTIONS:-20}
-      OCR_PROJECT_ROOT: /app/subservices/ocr-worker
+      OCR_BASE_URL: http://ocr-worker:8100
       CLAIM_BASE_URL: ${CLAIM_BASE_URL:-http://localhost/#/claim}
       TENCENT_REDEEM_PROOF_MODE: ${TENCENT_REDEEM_PROOF_MODE:-full}
       TENCENT_BROWSER_HEADLESS: ${TENCENT_BROWSER_HEADLESS:-true}