FACILE
National File Format Validation Service
Sole developer of a national public service that checks whether a file is well-formed, valid and archivable before long-term preservation at CINES.
- Docker image size
- -83%
- Docker image size
- concurrent users load-tested
- 100
- concurrent users load-tested
- known vulnerabilities
- 0
- known vulnerabilities
Overview
FACILE is a free public web service run by CINES that answers three questions about a file: is it well-formed, is it valid, is it archivable? It serves PhD students submitting their thesis as well as institutions preparing an archive transfer, and third-party systems call it automatically through its REST API. It relies on the CINES format validator, which orchestrates about twenty specialized modules (DROID, veraPDF, JHOVE...), and offers correction and PDF/A conversion of non-compliant documents. I joined the application as an intern in 2024 and I am now its sole developer: I write its specifications, lead its 2.1 overhaul and represent it before the IT department.
Key features
- Format validation through the CINES validator (DROID, veraPDF, JHOVE, ffmpeg...)
- Correction and PDF/A conversion of non-compliant documents
- REST API used by third-party systems, with a fair queue
- Docker image reduced from 4.4 GB to 768 MB (-83%)
- Rootless, read-only Docker container behind an Apache reverse proxy
- Number of concurrent validations computed from available memory
- Automatic restart (systemd watchdog) and heap dump on memory exhaustion
- No known vulnerability after a double scan with Docker Scout and OWASP Dependency-Check
- RGAA accessibility compliance under way
Context
CINES (French National Computing Center for Higher Education) is a public institution that, among other missions, provides long-term digital preservation for higher education and research data. Within the Archiving and Data Services Department (DASD), I joined FACILE as an intern in 2024, then as a work-study student during the last year of my Bachelor's degree. Since September 2025 I have continued as an engineering apprentice (IMT Mines Alès, INFRES program). In a twelve-person team that maintains several national applications, I am now the sole developer of FACILE, whose version 2.1 is being prepared for national production.
What I did
Internship (June to September 2024)
- Migrated FACILE to Java 11 and updated server configurations (Tomcat, Ghostscript).
- Improved the interface: PDF correction pages, dashboards, ticketing system.
Bachelor work-study (September 2024 to August 2025)
- Overhauled the application and wrote version 2.0 of the functional and technical specifications.
- Improved validation, correction and printing features, integrated the CINES validator and DROID.
- First deployment on a Kubernetes cluster, Docker hardening and CVE fixes.
Engineering apprenticeship (since September 2025)
- Rebuilt the Docker image as a multi-stage build, then kept slimming it down: from 4.4 GB to 1.61 GB, then to 768 MB (-83%).
- Adapted the image to the shared CINES Kubernetes cluster (non-root execution, read-only file system, probes), then moved, as decided with the CISO and IT department, to a rootless Docker container behind Apache.
- Memory-based sizing: each veraPDF validation takes about 750 MiB, so the validator pool is computed at startup (3 concurrent validations on 6 GB) and extra requests wait their turn instead of failing.
- Version 2.1 overhaul: code and operations audit, requirements specification, eight work packages with acceptance criteria, upgrade to Jakarta EE 11, Tomcat 11 and PrimeFaces 16, security fixes delivered first.
- Resilience: systemd watchdog, heap dump and automatic restart, bounded network timeouts (one XML file used to block the validator for 7 min 41 s).
- Load test with 100 concurrent users (validation, correction and API).
- Started RGAA accessibility compliance and deployed a JHOVE fix to production after testing it on a server replica.
- Contributed to the CINES HDS (health data hosting) certification: studied four ISO/IEC 27002 controls and co-wrote the secure development project lifecycle.
- Write and maintain the requirements, functional and technical specifications and architecture document, and represent the application before the IT department.
Lessons learned
- Size a service to its real needs rather than to a reference model: a single, well-calibrated instance replaced a Kubernetes cluster that had to compensate for problems it created itself.
- Working in development is not validation: every work package now requires acceptance testing in pre-production.
- Code is written locally, goes through the GitLab forge, which is the single source of truth, and is never edited on a server.
- Documenting decisions ensures a service outlives the departure of its author.