Lucas RayanandClaude Sonnet 5
8a80504c45
Release / Plan (reuse the published image?) (push) Successful in 3s
CI / Docker image (build and smoke test) (push) Skipped
CI / Format and clippy (push) Successful in 4m32s
CI / Dependency audit (push) Successful in 11s
CI / Tests (Linux) (push) Successful in 9m15s
Release / ci (push) Successful in 9m18s
Release / Build image (arm64) (push) Failing after 7m7s
Release / Build image (amd64) (push) Failing after 13m53s
Release / Publish tags (push) Skipped
Release / Gitea release (push) Skipped
Acaua is a collective SOC daemon consuming only Zeek log files, not a single-user tool needing local hardware like its siblings. Drop the Tauri desktop shell, installers and self-update entirely; the server and its web dashboard ship as a container, updated by pulling a new image tag. Link against the official prebuilt libduckdb instead of compiling it from source via the bundled feature, cutting image build time from 15+ minutes to about 3. Fix a real bug found along the way: as PID 1 in a container, the daemon ignored SIGTERM and was always killed after the stop timeout; it now shuts down gracefully. Also corrects the Pillar 1 beaconing score: the period estimate had a harmonic alias (a perfectly periodic 4h series resolved to 600s), and the old score formula flagged pure random traffic as suspicious (p95 = 0.839 on Poisson noise). The new formula was validated against 300 samples per scenario. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
52 lines
2.3 KiB
Docker
52 lines
2.3 KiB
Docker
# syntax=docker/dockerfile:1
|
|
#
|
|
# Acauã server image: the acaua daemon (API and embedded web dashboard) linked
|
|
# against the official prebuilt libduckdb. DuckDB is never compiled here.
|
|
|
|
# Build stage.
|
|
FROM rust:1.99-slim-trixie AS build
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates curl unzip \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
COPY scripts/fetch-libduckdb.sh /usr/local/bin/fetch-libduckdb.sh
|
|
RUN fetch-libduckdb.sh /opt/duckdb \
|
|
&& echo /opt/duckdb > /etc/ld.so.conf.d/duckdb.conf \
|
|
&& ldconfig
|
|
ENV DUCKDB_LIB_DIR=/opt/duckdb \
|
|
DUCKDB_INCLUDE_DIR=/opt/duckdb
|
|
WORKDIR /src
|
|
COPY Cargo.toml Cargo.lock ./
|
|
COPY crates crates
|
|
COPY apps/gui/ui apps/gui/ui
|
|
COPY logo.png logo.png
|
|
# The ldd check fails the build if the binary is not linked to the shared
|
|
# libduckdb (for example if someone re-enables the `bundled` feature).
|
|
RUN cargo build --release --locked -p acaua-cli \
|
|
&& ldd target/release/acaua | grep -q 'libduckdb.so => /opt/duckdb/libduckdb.so'
|
|
|
|
# Runtime stage: Debian slim, the binary, libduckdb.so, CA certificates and
|
|
# curl (update check and HEALTHCHECK). Runs as an unprivileged user.
|
|
FROM debian:trixie-slim
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates curl libstdc++6 \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& groupadd --system --gid 10001 acaua \
|
|
&& useradd --system --uid 10001 --gid 10001 --home-dir /data --shell /usr/sbin/nologin acaua \
|
|
&& mkdir -p /data/acaua /data/zeek \
|
|
&& chown acaua:acaua /data/acaua
|
|
COPY --from=build /opt/duckdb/libduckdb.so /opt/duckdb/.duckdb-release /opt/duckdb/
|
|
RUN echo /opt/duckdb > /etc/ld.so.conf.d/duckdb.conf && ldconfig
|
|
COPY --from=build /src/target/release/acaua /usr/local/bin/acaua
|
|
LABEL org.opencontainers.image.title="Acauã" \
|
|
org.opencontainers.image.description="Network threat hunting with deterministic evidence" \
|
|
org.opencontainers.image.source="https://git.lucasrguerra.dev.br/ciberfauna/acaua" \
|
|
org.opencontainers.image.licenses="MIT OR Apache-2.0"
|
|
ENV ACAUA_RUNTIME=container
|
|
USER acaua
|
|
WORKDIR /data
|
|
EXPOSE 8787
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD curl -fsS http://127.0.0.1:8787/api/health >/dev/null || exit 1
|
|
ENTRYPOINT ["acaua"]
|
|
CMD ["serve", "--bind", "0.0.0.0:8787", "--data-dir", "/data/acaua"]
|