87 lines
3.8 KiB
Docker
87 lines
3.8 KiB
Docker
FROM rust:1.94-bookworm AS builder
|
|
|
|
WORKDIR /app
|
|
COPY . .
|
|
# compliance-agent depends on the private tramiton-core git repo. Authenticate
|
|
# the fetch with a PAT passed as a BuildKit secret (never baked into a layer).
|
|
# Build with: DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN ...
|
|
RUN --mount=type=secret,id=tramiton_token \
|
|
if [ -s /run/secrets/tramiton_token ]; then \
|
|
git config --global \
|
|
url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
|
|
"ssh://git@gitea.meghsakha.com:22222/"; \
|
|
fi && \
|
|
CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-agent
|
|
|
|
# A throwaway stage that packs a real nix store (store paths + the validity DB)
|
|
# into a compressed bootstrap tarball. Only the tarball is copied into the final
|
|
# image, so we don't carry a raw /nix copy layer.
|
|
FROM nixos/nix:latest AS nixseed
|
|
RUN tar -C / -czf /nix-bootstrap.tar.gz nix
|
|
|
|
FROM debian:bookworm-slim
|
|
RUN apt-get update && apt-get install -y ca-certificates libssl3 git curl python3 python3-pip npm golang-go php-cli && rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install Cargo (minimal, for cargo metadata / cargo audit / generate-lockfile)
|
|
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
|
|
ENV PATH="/root/.cargo/bin:${PATH}"
|
|
RUN cargo install cargo-audit
|
|
|
|
# Install Composer for PHP dependency resolution
|
|
RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
|
|
|
|
# Install Bundler for Ruby dependency resolution
|
|
RUN apt-get update && apt-get install -y ruby && rm -rf /var/lib/apt/lists/* && gem install bundler
|
|
|
|
# Install syft for SBOM generation
|
|
RUN curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
|
|
|
|
# Install gitleaks for secret detection
|
|
RUN curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz \
|
|
| tar -xz -C /usr/local/bin gitleaks
|
|
|
|
# Install semgrep for static analysis
|
|
RUN pip3 install --break-system-packages semgrep
|
|
|
|
# Install ruff for Python linting
|
|
RUN pip3 install --break-system-packages ruff
|
|
|
|
# Real nix for the tramiton reproducible-build firmware SBOM.
|
|
#
|
|
# nix-portable's proot fallback can't run here: user namespaces are blocked by
|
|
# the container's default seccomp/apparmor profile, and orca exposes no way to
|
|
# relax it. So ship a *real* nix and disable its build sandbox
|
|
# (`sandbox = false`) — a plain gcc/make firmware build needs no user namespace,
|
|
# so it runs fine under the locked-down profile with no proot involved.
|
|
#
|
|
# The store is shipped as a bootstrap tarball and seeded onto /nix at first
|
|
# start (see docker/agent-entrypoint.sh), so a persistent /nix volume survives
|
|
# redeploys. A missing/broken nix just falls back to the analysis-only SBOM.
|
|
COPY --from=nixseed /nix-bootstrap.tar.gz /opt/nix-bootstrap.tar.gz
|
|
ENV PATH="/nix/var/nix/profiles/default/bin:${PATH}"
|
|
RUN mkdir -p /etc/nix && printf '%s\n' \
|
|
'experimental-features = nix-command flakes' \
|
|
'sandbox = false' \
|
|
'build-users-group =' \
|
|
'substituters = https://cache.nixos.org' \
|
|
'trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=' \
|
|
> /etc/nix/nix.conf
|
|
|
|
COPY --from=builder /app/target/release/compliance-agent /usr/local/bin/compliance-agent
|
|
COPY docker/agent-entrypoint.sh /usr/local/bin/agent-entrypoint.sh
|
|
RUN chmod +x /usr/local/bin/agent-entrypoint.sh
|
|
|
|
# Copy documentation for the help chat assistant
|
|
COPY --from=builder /app/README.md /app/README.md
|
|
COPY --from=builder /app/docs /app/docs
|
|
ENV HELP_DOCS_PATH=/app
|
|
|
|
# Ensure SSH key directory exists
|
|
RUN mkdir -p /data/compliance-scanner/ssh
|
|
|
|
EXPOSE 3001 3002
|
|
|
|
# Seeds /nix (fresh volume) from the bootstrap tarball, then runs the agent.
|
|
ENTRYPOINT ["/usr/local/bin/agent-entrypoint.sh"]
|
|
|