52 lines
4.6 KiB
Docker
52 lines
4.6 KiB
Docker
FROM python:3.12-slim
|
|
|
|
WORKDIR /app
|
|
|
|
# ── System deps + Chromium + Terraform + nginx + supervisor ─────────────────
|
|
ARG TERRAFORM_VERSION=1.14.7
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
curl gcc libffi-dev unzip \
|
|
chromium fonts-liberation fonts-dejavu-core fontconfig \
|
|
nginx supervisor && \
|
|
ARCH=$(dpkg --print-architecture) && \
|
|
curl -fsSL "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_${ARCH}.zip" -o /tmp/tf.zip && \
|
|
unzip /tmp/tf.zip -d /usr/local/bin/ && rm /tmp/tf.zip && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
# ── Python deps + OCI CLI ───────────────────────────────────────────────────
|
|
COPY backend/requirements.txt .
|
|
RUN pip install --no-cache-dir -r requirements.txt && \
|
|
pip install --no-cache-dir oci-cli
|
|
|
|
# ── Backend app ─────────────────────────────────────────────────────────────
|
|
COPY backend/app.py .
|
|
COPY backend/cis_reports.py .
|
|
COPY backend/mcp_cis_server.py .
|
|
COPY backend/gen_tf_reference.py .
|
|
|
|
# ── Frontend (pre-built React SPA) ─────────────────────────────────────────
|
|
RUN rm -rf /usr/share/nginx/html/*
|
|
COPY frontend/dist /usr/share/nginx/html/app
|
|
|
|
# ── Nginx config (proxy to localhost instead of backend hostname) ───────────
|
|
RUN printf 'map $uri $empty {\n default "";\n}\n\nserver {\n listen 8080;\n server_name _;\n client_max_body_size 50M;\n absolute_redirect off;\n\n location / {\n root /usr/share/nginx/html/app;\n try_files $uri $uri/ /index.html;\n add_header Cache-Control "no-cache, no-store, must-revalidate" always;\n add_header X-Frame-Options "DENY" always;\n add_header X-Content-Type-Options "nosniff" always;\n add_header X-XSS-Protection "1; mode=block" always;\n add_header Referrer-Policy "strict-origin-when-cross-origin" always;\n add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;\n }\n\n location /api/ {\n proxy_pass http://127.0.0.1:8000/api/;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n proxy_set_header X-Forwarded-Proto $scheme;\n proxy_read_timeout 900s;\n proxy_send_timeout 900s;\n proxy_connect_timeout 60s;\n add_header X-Frame-Options "SAMEORIGIN" always;\n add_header X-Content-Type-Options "nosniff" always;\n }\n}\n' > /etc/nginx/sites-available/default
|
|
|
|
# ── Supervisord config ──────────────────────────────────────────────────────
|
|
RUN printf '[supervisord]\nnodaemon=true\nuser=root\nlogfile=/var/log/supervisor/supervisord.log\nlogfile_maxbytes=10MB\n\n[program:backend]\ncommand=runuser -u agent -- uvicorn app:app --host 127.0.0.1 --port 8000 --workers 8\ndirectory=/app\nautostart=true\nautorestart=true\nstdout_logfile=/dev/fd/1\nstdout_logfile_maxbytes=0\nstderr_logfile=/dev/fd/2\nstderr_logfile_maxbytes=0\n\n[program:nginx]\ncommand=nginx -g "daemon off;"\nautostart=true\nautorestart=true\nstdout_logfile=/dev/fd/1\nstdout_logfile_maxbytes=0\nstderr_logfile=/dev/fd/2\nstderr_logfile_maxbytes=0\n' > /etc/supervisor/conf.d/app.conf
|
|
|
|
# ── Non-root user + data dir ────────────────────────────────────────────────
|
|
RUN groupadd -r agent && useradd -r -g agent -d /app -s /bin/bash agent && \
|
|
mkdir -p /data /var/log/supervisor && chown -R agent:agent /app /data
|
|
|
|
# ── Generate Terraform resource reference ───────────────────────────────────
|
|
RUN python gen_tf_reference.py || echo "WARN: tf reference generation skipped"
|
|
|
|
# ── Entrypoint ──────────────────────────────────────────────────────────────
|
|
RUN printf '#!/bin/bash\nchown -R agent:agent /data 2>/dev/null || true\nexec supervisord -c /etc/supervisor/conf.d/app.conf\n' > /entrypoint.sh && \
|
|
chmod +x /entrypoint.sh
|
|
|
|
VOLUME /data
|
|
EXPOSE 8080
|
|
|
|
ENTRYPOINT ["/entrypoint.sh"]
|