How I Built a Secure LaTeX-to-PDF Service for Cloudflare Workers

Your app cannot create PDFs directly on Cloudflare Workers. The issue lies in the architecture and limitations of Workers. Workers are V8 isolates - sandboxed environments for JavaScript and WebAssembly. They lack native binaries and cannot run TeX engines required to compile .tex files to PDFs. TeX engines like pdflatex, xelatex, and Tectonic are native binaries that expect a real operating system with file system access, which is not available in Workers.

Tectonic, a different TeX engine, fetches support files on demand, runs as many passes as needed, and does not leave intermediate files behind by default. These features make it a better fit for a server environment. However, shell escape is disabled by default to prevent malicious documents from running arbitrary shell commands on the server.

This restriction means certain LaTeX packages, like minted, cannot be used. To enhance security, the compiler is given a clean environment, and the service token is not stored in the compiler's environment. This way, even if a malicious document were to be compiled, it could not leak sensitive information or execute arbitrary commands on the server.