GLIBC_2.39 not found fix, using musl

Author: vsilent

.github/workflows/docker.yml

@@ -17,10 +17,14 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt, clippy
+          targets: x86_64-unknown-linux-musl
 
       - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@v2
 
+      - name: Install cross
+        run: cargo install cross --git https://github.com/cross-rs/cross
+
       - name: Generate Secret Key
         run: head -c16 /dev/urandom > src/secret.key
 
@@ -36,8 +40,8 @@ jobs:
       - name: Test
         run: cargo test
 
-      - name: Build release
-        run: cargo build --release
+      - name: Build static release
+        run: cross build --release --target x86_64-unknown-linux-musl
 
       - name: Build frontend
         working-directory: ./web
@@ -52,7 +56,7 @@ jobs:
       - name: Package app
         run: |
           mkdir -p app/stackdog/dist
-          cp target/release/stackdog app/stackdog/
+          cp target/x86_64-unknown-linux-musl/release/stackdog app/stackdog/
           cp -a web/dist/. app/stackdog/
           cp docker/prod/Dockerfile app/Dockerfile
           touch app/.env

README.md

@@ -71,6 +71,59 @@ cargo run
 cargo run -- serve
 ```
 
+### Run with Docker
+
+Use the published container image for the quickest way to explore the API.
+If you are validating a fresh branch or waiting for Docker Hub to pick up the latest CI build,
+prefer the local-image flow below so you know you are running your current checkout:
+
+```bash
+docker volume create stackdog-data
+
+docker run --rm -it \
+  --name stackdog \
+  -p 5000:5000 \
+  -e APP_HOST=0.0.0.0 \
+  -e APP_PORT=5000 \
+  -e DATABASE_URL=/data/stackdog.db \
+  -v stackdog-data:/data \
+  trydirect/stackdog:latest
+```
+
+Then open another shell and hit the API:
+
+```bash
+curl http://localhost:5000/api/security/status
+curl http://localhost:5000/api/threats
+curl http://localhost:5000/api/alerts
+```
+
+To try log sniffing inside Docker against host log files, mount them read-only and run the
+`sniff` subcommand instead of the default HTTP server:
+
+```bash
+docker run --rm -it \
+  -e DATABASE_URL=/tmp/stackdog.db \
+  -v /var/log:/host-logs:ro \
+  trydirect/stackdog:latest \
+  sniff --once --sources /host-logs/auth.log
+```
+
+If you want to test your current checkout instead of the latest published image:
+
+```bash
+docker build -f docker/local/Dockerfile -t stackdog-local .
+
+docker run --rm -it \
+  --name stackdog-local \
+  -p 5000:5000 \
+  -e APP_HOST=0.0.0.0 \
+  -e APP_PORT=5000 \
+  -e DATABASE_URL=/data/stackdog.db \
+  -v stackdog-data:/data \
+  stackdog-local
+```
+
 ### Log Sniffing
 
 ```bash
@@ -120,11 +173,12 @@ for event in events {
 ### Docker Development
 
 ```bash
-# Start development environment
-docker-compose up -d
+# Run the published image
+docker run --rm -it -p 5000:5000 trydirect/stackdog:latest
 
-# View logs
-docker-compose logs -f stackdog
+# Or, for the most reliable test of your current code, build and run your checkout
+docker build -f docker/local/Dockerfile -t stackdog-local .
+docker run --rm -it -p 5000:5000 stackdog-local
 ```
 
 ---

docker-compose.app.yml

@@ -0,0 +1,31 @@
+services:
+  stackdog:
+    build:
+      context: .
+      dockerfile: docker/local/Dockerfile
+    command: ["serve"]
+    container_name: stackdog
+    environment:
+      APP_HOST: 0.0.0.0
+      APP_PORT: 5000
+      DATABASE_URL: /data/stackdog.db
+    ports:
+      - "5000:5000"
+    volumes:
+      - stackdog-data:/data
+
+  stackdog-ui:
+    build:
+      context: .
+      dockerfile: docker/ui/Dockerfile
+      args:
+        REACT_APP_API_URL: http://localhost:5000/api
+        REACT_APP_WS_URL: ws://localhost:5000/ws
+    container_name: stackdog-ui
+    depends_on:
+      - stackdog
+    ports:
+      - "3000:80"
+
+volumes:
+  stackdog-data:

docker/ui/Dockerfile

@@ -0,0 +1,27 @@
+FROM node:20-alpine AS build
+
+WORKDIR /web
+
+COPY web/package*.json ./
+RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
+
+COPY web/ ./
+
+ARG REACT_APP_API_URL=
+ARG REACT_APP_WS_URL=
+ARG APP_PORT=
+ARG REACT_APP_API_PORT=
+
+ENV REACT_APP_API_URL=${REACT_APP_API_URL}
+ENV REACT_APP_WS_URL=${REACT_APP_WS_URL}
+ENV APP_PORT=${APP_PORT}
+ENV REACT_APP_API_PORT=${REACT_APP_API_PORT}
+
+RUN npm run build
+
+FROM nginx:1.27-alpine
+
+COPY docker/ui/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /web/dist /usr/share/nginx/html
+
+EXPOSE 80

docker/ui/nginx.conf

@@ -0,0 +1,11 @@
+server {
+    listen 80;
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}