Add uwsgi vars to docker-compose.yml #11186
Conversation
DryRun Security SummaryThe provided code change in the Expand for full summarySummary: The provided code change in the From an application security perspective, it is important to ensure that the entire deployment process, including the configuration of environment variables, database connections, and volume mounts, is properly secured to mitigate potential security risks. This includes ensuring that sensitive information, such as the Files Changed:
Code AnalysisWe ran Riskiness🟢 Risk threshold not exceeded. |
|
Any idea, why these django-DefectDojo/Dockerfile.nginx-debian Lines 92 to 93 in fb442d2 django-DefectDojo/Dockerfile.nginx-alpine Lines 159 to 160 in fb442d2 are not enough? |
|
@kiblik your snippet will work in case you build your local image. |
Please tell where I'm wrong but I see it as part of public image as well (layer 25): https://hub.docker.com/layers/defectdojo/defectdojo-nginx/2.39.4-debian/images/sha256-61d336d0100f6b505af222b6e49d8ccb0f1cb7951e5ec24541a934286a9cec8a?context=explore You mentioned |
|
@optimistic5 I agree with @kiblik here. You can either set an env variable or add it to the compose stanza when using the existing upstream container image directly from Docker hub. Have you tried adding a stanza similar to the below to your compose section for Nginx to override the default? (assuming you wanted port 3333) Here's the relevant line of the Nginx container entrypoint script that set's that dynamically. I've done this in the past without any issue/problems. |
|
no, no. Lets took official
docker-compose.yml# This docker-compose.yml file is fully functional to evaluate DefectDojo
# in your local environment.
#
# Although Docker Compose is one of the supported installation methods to
# deploy a containerized DefectDojo in a production environment, the
# docker-compose.yml file is not intended for production use without first
# customizing it to your particular situation.
---
services:
nginx:
image: "defectdojo/defectdojo-nginx:${NGINX_VERSION:-latest}"
depends_on:
- dd-demo-uwsgi
environment:
NGINX_METRICS_ENABLED: "${NGINX_METRICS_ENABLED:-false}"
volumes:
- defectdojo_media:/usr/share/nginx/html/media
ports:
- target: 8080
published: ${DD_PORT:-8080}
protocol: tcp
mode: host
- target: 8443
published: ${DD_TLS_PORT:-8443}
protocol: tcp
mode: host
dd-demo-uwsgi:
image: "defectdojo/defectdojo-django:${DJANGO_VERSION:-latest}"
depends_on:
- postgres
entrypoint: ['/wait-for-it.sh', '${DD_DATABASE_HOST:-postgres}:${DD_DATABASE_PORT:-5432}', '-t', '30', '--', '/entrypoint-uwsgi.sh']
environment:
DD_DEBUG: 'False'
DD_DJANGO_METRICS_ENABLED: "${DD_DJANGO_METRICS_ENABLED:-False}"
DD_ALLOWED_HOSTS: "${DD_ALLOWED_HOSTS:-*}"
DD_DATABASE_URL: ${DD_DATABASE_URL:-postgresql://defectdojo:defectdojo@postgres:5432/defectdojo}
DD_CELERY_BROKER_URL: ${DD_CELERY_BROKER_URL:-redis://redis:6379/0}
DD_SECRET_KEY: "${DD_SECRET_KEY:-hhZCp@D28z!n@NED*yB!ROMt+WzsY*iq}"
DD_CREDENTIAL_AES_256_KEY: "${DD_CREDENTIAL_AES_256_KEY:-&91a*agLqesc*0DJ+2*bAbsUZfR*4nLw}"
DD_DATABASE_READINESS_TIMEOUT: "${DD_DATABASE_READINESS_TIMEOUT:-30}"
volumes:
- type: bind
source: ./docker/extra_settings
target: /app/docker/extra_settings
- "defectdojo_media:${DD_MEDIA_ROOT:-/app/media}"
celerybeat:
image: "defectdojo/defectdojo-django:${DJANGO_VERSION:-latest}"
depends_on:
- postgres
- redis
entrypoint: ['/wait-for-it.sh', '${DD_DATABASE_HOST:-postgres}:${DD_DATABASE_PORT:-5432}', '-t', '30', '--', '/entrypoint-celery-beat.sh']
environment:
DD_DATABASE_URL: ${DD_DATABASE_URL:-postgresql://defectdojo:defectdojo@postgres:5432/defectdojo}
DD_CELERY_BROKER_URL: ${DD_CELERY_BROKER_URL:-redis://redis:6379/0}
DD_SECRET_KEY: "${DD_SECRET_KEY:-hhZCp@D28z!n@NED*yB!ROMt+WzsY*iq}"
DD_CREDENTIAL_AES_256_KEY: "${DD_CREDENTIAL_AES_256_KEY:-&91a*agLqesc*0DJ+2*bAbsUZfR*4nLw}"
DD_DATABASE_READINESS_TIMEOUT: "${DD_DATABASE_READINESS_TIMEOUT:-30}"
volumes:
- type: bind
source: ./docker/extra_settings
target: /app/docker/extra_settings
celeryworker:
image: "defectdojo/defectdojo-django:${DJANGO_VERSION:-latest}"
depends_on:
- postgres
- redis
entrypoint: ['/wait-for-it.sh', '${DD_DATABASE_HOST:-postgres}:${DD_DATABASE_PORT:-5432}', '-t', '30', '--', '/entrypoint-celery-worker.sh']
environment:
DD_DATABASE_URL: ${DD_DATABASE_URL:-postgresql://defectdojo:defectdojo@postgres:5432/defectdojo}
DD_CELERY_BROKER_URL: ${DD_CELERY_BROKER_URL:-redis://redis:6379/0}
DD_SECRET_KEY: "${DD_SECRET_KEY:-hhZCp@D28z!n@NED*yB!ROMt+WzsY*iq}"
DD_CREDENTIAL_AES_256_KEY: "${DD_CREDENTIAL_AES_256_KEY:-&91a*agLqesc*0DJ+2*bAbsUZfR*4nLw}"
DD_DATABASE_READINESS_TIMEOUT: "${DD_DATABASE_READINESS_TIMEOUT:-30}"
volumes:
- type: bind
source: ./docker/extra_settings
target: /app/docker/extra_settings
- "defectdojo_media:${DD_MEDIA_ROOT:-/app/media}"
initializer:
image: "defectdojo/defectdojo-django:${DJANGO_VERSION:-latest}"
depends_on:
- postgres
entrypoint: ['/wait-for-it.sh', '${DD_DATABASE_HOST:-postgres}:${DD_DATABASE_PORT:-5432}', '--', '/entrypoint-initializer.sh']
environment:
DD_DATABASE_URL: ${DD_DATABASE_URL:-postgresql://defectdojo:defectdojo@postgres:5432/defectdojo}
DD_ADMIN_USER: "${DD_ADMIN_USER:-admin}"
DD_ADMIN_MAIL: "${DD_ADMIN_USER:-admin@defectdojo.local}"
DD_ADMIN_FIRST_NAME: "${DD_ADMIN_FIRST_NAME:-Admin}"
DD_ADMIN_LAST_NAME: "${DD_ADMIN_LAST_NAME:-User}"
DD_INITIALIZE: "${DD_INITIALIZE:-true}"
DD_SECRET_KEY: "${DD_SECRET_KEY:-hhZCp@D28z!n@NED*yB!ROMt+WzsY*iq}"
DD_CREDENTIAL_AES_256_KEY: "${DD_CREDENTIAL_AES_256_KEY:-&91a*agLqesc*0DJ+2*bAbsUZfR*4nLw}"
DD_DATABASE_READINESS_TIMEOUT: "${DD_DATABASE_READINESS_TIMEOUT:-30}"
volumes:
- type: bind
source: ./docker/extra_settings
target: /app/docker/extra_settings
postgres:
image: postgres:17.0-alpine@sha256:14195b0729fce792f47ae3c3704d6fd04305826d57af3b01d5b4d004667df174
environment:
POSTGRES_DB: ${DD_DATABASE_NAME:-defectdojo}
POSTGRES_USER: ${DD_DATABASE_USER:-defectdojo}
POSTGRES_PASSWORD: ${DD_DATABASE_PASSWORD:-defectdojo}
volumes:
- defectdojo_postgres:/var/lib/postgresql/data
redis:
image: redis:7.2.5-alpine@sha256:6aaf3f5e6bc8a592fbfe2cccf19eb36d27c39d12dab4f4b01556b7449e7b1f44
volumes:
- defectdojo_redis:/data
volumes:
defectdojo_postgres: {}
defectdojo_media: {}
defectdojo_redis: {}What will happen? To solve it during |
|
If you change name of container in I do not understand why it is needed to define the same defaults on 2 different places. And if you see it handy for others, to let them know, what need to be adjusted in case of change of container name, I suppose it might be done in documentation. |
|
@kiblik
In Dockerfile.django-debian we already have variables like at the same time in
Thank you. |
|
@optimistic5, now I better understand your point of view. Thank you. TBH, I'm also not happy about other defaults (you listed I do not have the capacity at the moment to perform this ^ kind of improvement. But I would be happy to know the options of others in the community. This is open source and if it makes sense to others, let's go for it. |
Description
Add variables for
nginxservice indocker-compose.yml.Without them, nginx will create default
/run/defectdojo/usgi_serverwhich isHaving these variables will give opportunity to change the name of the
uwsgiservice indocker-compose.ymland properly create/run/defectdojo/usgi_server