Docling Serve Document Conversion API AMI by cloudimg

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

Docling Serve is a self-hosted HTTP API that converts PDF, DOCX, PPTX, HTML and image files into clean, machine-readable Markdown or JSON with real layout and table understanding. Backed by the Linux Foundation AI and Data community, this AMI delivers a fully built, hardened conversion appliance that is operational within minutes of launch - no manual package installation, no documents leaving your network, and no third-party API dependencies.

This image eliminates the manual work of building a Python environment, installing CPU-only PyTorch and docling-serve, downloading and licence-vetting machine-learning models, authoring systemd units, configuring an authenticated reverse proxy and hardening credentials. The layout, table-structure and OCR models are baked in at build time and verified against their licence, so document and scanned-image conversion works fully offline out of the box. Launch the instance, read your unique credential, and start converting documents immediately.

Evaluation path: Launch a small instance for a short session to test the API against your own documents at minimal infrastructure cost. No long-term commitment is required - terminate the instance when your evaluation is complete.

• Document ingestion for AI and RAG pipelines: convert PDFs, Office documents and HTML into clean Markdown or JSON as the pre-processing step feeding a retrieval-augmented-generation system or search index, entirely within your own account
• Table and layout extraction: extract structured tables and reading-order layout from invoices, reports and scientific papers into machine-readable form
• Offline OCR of scanned documents: convert scanned or image-only documents to text with the baked OCR engine, with no document ever leaving the instance

The docling-serve backend runs under systemd as an unprivileged system user and binds to the loopback interface only. It is fronted by an nginx reverse proxy on port 80 that requires HTTP Basic Auth on every path except a static, unauthenticated health probe for load balancers. The standard docling-serve client paths are preserved unchanged through the proxy, so existing clients, the interactive UI and Swagger docs all work by pointing at the instance with credentials. systemd starts the service and the web server on boot and restarts them on failure.

Document conversion is driven by machine-learning models that are separately licensed artifacts. This image bakes only permissively licensed models, each verified at build time against its own model card and recorded with a per-file checksum in an on-image provenance file:

• Layout analysis: the Docling heron layout model (Apache-2.0)
• Table structure: Docling TableFormer (CDLA-Permissive-2.0)
• OCR: RapidOCR / PP-OCR for scanned and image documents (Apache-2.0)

All permit commercial use and redistribution. A fail-closed build-time scan aborts on any copyleft or non-commercial marker anywhere in the model download, and a whole-environment licence sweep rejects any restrictive transitive dependency.

• Network isolation: the conversion backend binds exclusively to the loopback interface; only the authenticated nginx proxy is exposed, and the security group opens only SSH and HTTP
• No default or shared credentials: a cryptographically random API password is generated on each instance's first boot and written only to a root-only file
• Authenticated by default: this image never exposes an open, unauthenticated conversion endpoint
• Least privilege: the service runs as an unprivileged system user under a hardened systemd unit
• Offline conversion: the models are baked and model downloads are disabled, so uploaded documents never leave your instance

Basic Auth rides over HTTP by default; terminate TLS on port 443 in front of the instance for production, as described in the deployment guide.

Deploy on any EC2 instance type. Front the instance with an Application Load Balancer terminating TLS with your own certificate, and use the unauthenticated health path as the target-group health check. Back up your configuration with EBS snapshots or AWS Backup.

Launch an instance from this AMI, retrieve your unique credential from the root-only file, and send your first document conversion request via curl or the built-in Swagger UI. For a guided deployment walkthrough or help integrating the API into your pipeline, contact cloudimg support at any time.