Dockerfile.nginx-alpine

# code: language=Dockerfile

# The code for the build image should be identical with the code in
# Dockerfile.django-alpine to use the caching mechanism of Docker.

# Ref: https://devguide.python.org/#branchstatus
FROM python:3.13.11-alpine3.22@sha256:2fd93799bfc6381d078a8f656a5f45d6092e5d11d16f55889b3d5cbfdc64f045 AS base
FROM base AS build
WORKDIR /app
RUN \
  apk update && \
  apk upgrade --no-cache && \
  apk add --no-cache \
    gcc \
    build-base \
    bind-tools \
    postgresql16-client \
    xmlsec \
    git \
    util-linux \
    curl-dev \
    openssl \
    libffi-dev \
    python3-dev \
    libpq-dev \
    && \
    rm -rf /var/cache/apk/* && \
  true
COPY requirements.txt requirements-dev.txt ./
# CPUCOUNT=1 is needed, otherwise the wheel for uwsgi won't always be build succesfully
# https://github.com/unbit/uwsgi/issues/1318#issuecomment-542238096
RUN CPUCOUNT=1 pip3 wheel --wheel-dir=/tmp/wheels -r ./requirements.txt
# needed for static files debug toolbar
RUN CPUCOUNT=1 pip3 wheel --wheel-dir=/tmp/wheels -r ./requirements-dev.txt


FROM build AS collectstatic
RUN apk add nodejs npm
RUN npm install -g yarn --force


# installing DefectDojo packages
RUN pip3 install \
	--no-cache-dir \
	--no-index \
  --find-links=/tmp/wheels \
	-r ./requirements.txt

# needed for static files debug toolbar
RUN pip3 install \
	--no-cache-dir \
	--no-index \
  --find-links=/tmp/wheels \
	-r ./requirements-dev.txt

# generate static files
COPY components/ ./components/
RUN \
  cd components && \
  yarn
COPY manage.py ./
COPY dojo/ ./dojo/
# always collect static for debug toolbar as we can't make it dependant on env variables or build arguments without breaking docker layer caching
RUN env DD_SECRET_KEY='.' DD_DJANGO_DEBUG_TOOLBAR_ENABLED=True python3 manage.py collectstatic --noinput --verbosity=2 && true

FROM nginx:1.29.3-alpine3.22@sha256:b3c656d55d7ad751196f21b7fd2e8d4da9cb430e32f646adcf92441b72f82b14 AS release
ARG uid=1001
ARG appuser=defectdojo
COPY --from=collectstatic /app/static/ /usr/share/nginx/html/static/
COPY wsgi_params nginx/nginx.conf nginx/nginx_TLS.conf /etc/nginx/
COPY docker/entrypoint-nginx.sh /
RUN \
  apk upgrade --no-cache && \
  apk add --no-cache openssl && \
  chmod -R g=u /var/cache/nginx && \
  mkdir /var/run/defectdojo && \
  chmod -R g=u /var/run/defectdojo && \
  mkdir -p /etc/nginx/ssl && \
  chmod -R g=u /etc/nginx && \
  rm -rf /var/cache/apk/* && \
  true
ENV \
  DD_UWSGI_PASS="uwsgi_server" \
  DD_UWSGI_HOST="uwsgi" \
  DD_UWSGI_PORT="3031" \
  GENERATE_TLS_CERTIFICATE="false" \
  USE_TLS="false" \
  NGINX_METRICS_ENABLED="false" \
  METRICS_HTTP_AUTH_USER="" \
  METRICS_HTTP_AUTH_PASSWORD=""
USER ${uid}
EXPOSE 8080
ENTRYPOINT ["/entrypoint-nginx.sh"]