Shipping a LaTeX Compiler Behind an Edge App

A job‑tracking service needs on‑demand PDF output from existing LaTeX CVs, but edge runtimes like Cloudflare Workers are V8 isolates that run only JS/Wasm and cannot spawn native TeX engines or host a full TeX Live install. The compile therefore runs off‑edge in a container the Worker calls over HTTP. Tectonic is chosen because it fetches only needed support files, automatically runs the necessary TeX/BibTeX passes, keeps intermediates small, and disables shell escape by default - making it compact and safer for a server environment - while keeping compatibility with an existing LaTeX codebase.

Security and operational details drive the implementation. The service is a small Node app with /health and authenticated POST /compile: each job gets an mkdtemp-created 0700 temp directory, files are written after resolving paths to reject traversal, and binaries run as an unprivileged process with a fresh environment so secrets aren’t exposed. File uploads accept text or base64 for binaries. The endpoint requires a bearer token checked in constant time, and the container fails to start without it (fail‑closed). Cloud Run’s shared, in‑memory filesystem and concurrency mean per‑job isolation, strict cleanup, and path checking are essential to avoid collisions, leaks, and accidental exposure.