| 1 | # ───────────────────────────────────────────── |
| 2 | # SOCFortress CoPilot Backend – Single-Stage Build |
| 3 | # Optimized with uv (Rust-based pip) |
| 4 | # Compatible with Debian 12 / ARM64 / x86_64 |
| 5 | # ───────────────────────────────────────────── |
| 6 | |
| 7 | FROM debian:12 |
| 8 | |
| 9 | # ─────────────── |
| 10 | # Core Environment |
| 11 | # ─────────────── |
| 12 | ENV PYTHONDONTWRITEBYTECODE=1 \ |
| 13 | PYTHONUNBUFFERED=1 \ |
| 14 | PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python \ |
| 15 | UV_CACHE_DIR=/root/.cache/uv \ |
| 16 | PATH="/opt/venv/bin:$PATH" |
| 17 | |
| 18 | # ─────────────── |
| 19 | # System Dependencies |
| 20 | # ─────────────── |
| 21 | RUN apt-get update && apt-get install -y \ |
| 22 | curl ca-certificates build-essential \ |
| 23 | python3.11 python3.11-venv python3.11-dev \ |
| 24 | libnss3 libatk-bridge2.0-0 libxkbcommon0 libgtk-3-0 libasound2 libx11-xcb1 \ |
| 25 | wkhtmltopdf libmagic1 file && \ |
| 26 | rm -rf /var/lib/apt/lists/* |
| 27 | |
| 28 | # ─────────────── |
| 29 | # Virtual Environment + uv |
| 30 | # ─────────────── |
| 31 | RUN python3.11 -m venv /opt/venv && \ |
| 32 | curl -LsSf https://astral.sh/uv/install.sh | sh && \ |
| 33 | ln -s /root/.local/bin/uv /usr/local/bin/uv |
| 34 | |
| 35 | WORKDIR /opt/copilot/backend |
| 36 | |
| 37 | # ─────────────── |
| 38 | # Install Dependencies |
| 39 | # ─────────────── |
| 40 | COPY requirements.txt ./ |
| 41 | RUN uv pip install -r requirements.txt --no-cache |
| 42 | |
| 43 | # ─────────────── |
| 44 | # Install Playwright Chromium |
| 45 | # ─────────────── |
| 46 | RUN /opt/venv/bin/python -m playwright install-deps && \ |
| 47 | /opt/venv/bin/python -m playwright install chromium |
| 48 | |
| 49 | # ─────────────── |
| 50 | # Copy Application |
| 51 | # ─────────────── |
| 52 | COPY . . |
| 53 | COPY wait-for-it.sh /usr/local/bin/wait-for-it.sh |
| 54 | RUN chmod +x /usr/local/bin/wait-for-it.sh && mkdir -p file-store |
| 55 | |
| 56 | # ─────────────── |
| 57 | # Expose API Port |
| 58 | # ─────────────── |
| 59 | EXPOSE 5000 |
| 60 | |
| 61 | # ─────────────── |
| 62 | # Runtime Environment |
| 63 | # ─────────────── |
| 64 | ENV SERVER_IP=0.0.0.0 \ |
| 65 | WAZUH_INDEXER_URL=https://1.1.1.1:9200 \ |
| 66 | WAZUH_INDEXER_USERNAME=admin \ |
| 67 | WAZUH_INDEXER_PASSWORD=admin \ |
| 68 | WAZUH_MANAGER_URL=https://1.1.1.1 \ |
| 69 | WAZUH_MANAGER_USERNAME=dummy \ |
| 70 | WAZUH_MANAGER_PASSWORD=dummy \ |
| 71 | GRAYLOG_URL=http://1.1.1.1 \ |
| 72 | GRAYLOG_USERNAME=dummy \ |
| 73 | GRAYLOG_PASSWORD=dummy \ |
| 74 | SHUFFLE_URL=https://1.1.1.1 \ |
| 75 | SHUFFLER_API_KEY=dummy \ |
| 76 | VELOCIRAPTOR_URL=https://1.1.1.1 \ |
| 77 | VELOCIRAPTOR_API_KEY_PATH=dummy \ |
| 78 | SUBLIME_URL=http://1.1.1.1 \ |
| 79 | SUBLIME_API_KEY=dummy \ |
| 80 | INFLUXDB_URL=http://1.1.1.1 \ |
| 81 | INFLUXDB_API_KEY=dummy \ |
| 82 | INFLUXDB_ORG_AND_BUCKET=dummy,dummy \ |
| 83 | ASKSOCFORTRESS_URL=https://knowledge.socfortress.co \ |
| 84 | ASKSOCFORTRESS_API_KEY=dummy \ |
| 85 | SOCFORTRESSTHREATINTEL_URL=https://intel.socfortress.co/search \ |
| 86 | SOCFORTRESSTHREATINTEL_API_KEY=dummy \ |
| 87 | CORTEX_URL=http://1.1.1.1 \ |
| 88 | CORTEX_API_KEY=dummy \ |
| 89 | GRAFANA_URL=http://1.1.1.1 \ |
| 90 | GRAFANA_USERNAME=dummy \ |
| 91 | GRAFANA_PASSWORD=dummy \ |
| 92 | WAZUH_WORKER_PROVISIONING_URL=http://1.1.1.1 \ |
| 93 | EVENT_SHIPPER_URL=graylog_host \ |
| 94 | GELF_INPUT_PORT=gelf_port \ |
| 95 | ALERT_CREATION_PROVISIONING_URL=http://1.1.1.1 |
| 96 | |
| 97 | # ─────────────── |
| 98 | # Optional Build ARG |
| 99 | # ─────────────── |
| 100 | ARG COPILOT_API_KEY |
| 101 | ENV COPILOT_API_KEY=$COPILOT_API_KEY |
| 102 | |
| 103 | # ─────────────── |
| 104 | # Start Application |
| 105 | # ─────────────── |
| 106 | CMD ["wait-for-it.sh", "copilot-mysql:3306", "--", "python", "copilot.py"] |