|
| 1 | +# syntax=docker/dockerfile:1 |
| 2 | +# |
| 3 | +# Multi-stage image: compile Scala/Play + AngularJS frontend, then run on the official Cortex base layer. |
| 4 | +# |
| 5 | +# Build: |
| 6 | +# docker build -t cortex:local . |
| 7 | +# |
| 8 | +# Run (example; point Elasticsearch at your cluster): |
| 9 | +# docker run --rm -p 9001:9001 cortex:local |
| 10 | +# |
| 11 | +# Requires network access during build (Maven/Ivy/npm, Debian/Corretto/Docker apt repos). |
| 12 | +# |
| 13 | +# Runtime matches project/DockerSettings.scala / builds/docker/Dockerfile (Debian + Corretto 11 + Docker). |
| 14 | +# To use the prebuilt base image instead (if you can pull it): replace the runtime FROM below with |
| 15 | +# FROM ghcr.io/strangebee/cortex-baselayer:rolling |
| 16 | +# and remove the duplicate RUN that installs Java/Docker/user (keep COPY and chmod). |
| 17 | + |
| 18 | +# ----------------------------------------------------------------------------- |
| 19 | +# Builder: JDK 11, sbt, Node (webpack), and bower (needed by www npm postinstall scripts) |
| 20 | +# ----------------------------------------------------------------------------- |
| 21 | +FROM eclipse-temurin:11-jdk-jammy AS builder |
| 22 | + |
| 23 | +ENV LANG=C.UTF-8 \ |
| 24 | + SBT_OPTS="-Xmx4096m -Xss2m" |
| 25 | + |
| 26 | +RUN apt-get update \ |
| 27 | + && apt-get install -y --no-install-recommends curl git gnupg ca-certificates \ |
| 28 | + && rm -rf /var/lib/apt/lists/* |
| 29 | + |
| 30 | +# sbt (version aligned with project/build.properties) |
| 31 | +RUN curl -fsSL "https://github.com/sbt/sbt/releases/download/v1.11.7/sbt-1.11.7.tgz" \ |
| 32 | + | tar xz -C /usr/local |
| 33 | + |
| 34 | +ENV PATH="/usr/local/sbt/bin:${PATH}" |
| 35 | + |
| 36 | +# Node.js 20 (for www: npm install + webpack via sbt) |
| 37 | +RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \ |
| 38 | + && apt-get update \ |
| 39 | + && apt-get install -y --no-install-recommends nodejs \ |
| 40 | + && rm -rf /var/lib/apt/lists/* |
| 41 | + |
| 42 | +# css-spaces and other legacy deps invoke `bower` in postinstall |
| 43 | +RUN npm install -g bower |
| 44 | + |
| 45 | +WORKDIR /build |
| 46 | + |
| 47 | +COPY . . |
| 48 | + |
| 49 | +RUN sbt -batch stage |
| 50 | + |
| 51 | +# ----------------------------------------------------------------------------- |
| 52 | +# Runtime: Debian + Amazon Corretto 11 + Docker CLI (same idea as builds/docker/Dockerfile) |
| 53 | +# ----------------------------------------------------------------------------- |
| 54 | +FROM debian:13-slim |
| 55 | + |
| 56 | +LABEL org.opencontainers.image.source="https://github.com/TheHive-Project/Cortex" |
| 57 | +LABEL org.opencontainers.image.description="Cortex built from source" |
| 58 | + |
| 59 | +WORKDIR /opt/cortex |
| 60 | + |
| 61 | +ENV JAVA_HOME=/usr/lib/jvm/java-11-amazon-corretto |
| 62 | + |
| 63 | +RUN apt-get update && apt-get upgrade -y \ |
| 64 | + && apt-get install -y --no-install-recommends ca-certificates curl gnupg \ |
| 65 | + && curl -fL https://apt.corretto.aws/corretto.key | gpg --dearmor -o /usr/share/keyrings/corretto.gpg \ |
| 66 | + && echo 'deb [signed-by=/usr/share/keyrings/corretto.gpg] https://apt.corretto.aws stable main' > /etc/apt/sources.list.d/corretto.list \ |
| 67 | + && apt-get update \ |
| 68 | + && apt-get install -y --no-install-recommends java-11-amazon-corretto-jdk \ |
| 69 | + && curl -fsSL https://download.docker.com/linux/debian/gpg -o /usr/share/keyrings/docker.asc \ |
| 70 | + && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" > /etc/apt/sources.list.d/docker.list \ |
| 71 | + && apt-get update \ |
| 72 | + && apt-get install -y --no-install-recommends docker-ce docker-ce-cli containerd.io docker-ce-rootless-extras uidmap iproute2 fuse-overlayfs \ |
| 73 | + && groupadd -g 1001 cortex \ |
| 74 | + && useradd --system --uid 1001 --gid 1001 --groups docker cortex -d /opt/cortex \ |
| 75 | + && mkdir -m 777 /var/log/cortex \ |
| 76 | + && chmod 666 /etc/subuid /etc/subgid \ |
| 77 | + && rm -rf /var/lib/apt/lists/* \ |
| 78 | + && apt-get clean -y -q \ |
| 79 | + && apt-get autoremove -y -q |
| 80 | + |
| 81 | +COPY --from=builder --chown=root:root /build/target/universal/stage/ /opt/cortex/ |
| 82 | + |
| 83 | +COPY --from=builder /build/package/docker/entrypoint /opt/cortex/entrypoint |
| 84 | +COPY --from=builder /build/conf/application.sample /etc/cortex/application.conf |
| 85 | +COPY --from=builder /build/package/logback.xml /etc/cortex/logback.xml |
| 86 | + |
| 87 | +RUN chmod +x /opt/cortex/bin/cortex /opt/cortex/entrypoint \ |
| 88 | + && chown -R cortex:cortex /etc/cortex |
| 89 | + |
| 90 | +VOLUME /var/lib/docker |
| 91 | + |
| 92 | +EXPOSE 9001 |
| 93 | + |
| 94 | +ENTRYPOINT ["/opt/cortex/entrypoint"] |
| 95 | +CMD [] |
0 commit comments