scanner/Dockerfile at main · bawbel/scanner · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
# ── Bawbel Scanner - Dockerfile ───────────────────────────────────────────────
#
# Three targets:
#
#   dev        - local development, all dev tools, editable install
#                docker build --target dev -t bawbel/scanner:dev .
#
#   test       - run the full test suite and exit
#                docker build --target test -t bawbel/scanner:test .
#                docker run --rm bawbel/scanner:test
#
#   production - minimal runtime image, non-root user, read-only fs
#                docker build --target production -t bawbel/scanner:1.2.0 .
#                docker run --rm -v $(pwd)/skills:/scan:ro bawbel/scanner:1.2.0 scan /scan
#
# Build args:
#
#   WITH_LLM=true       include litellm for LLM semantic engine (default: false)
#   WITH_SANDBOX=true   include sandbox execution engine (default: false)
#   WITH_ALL=true       include all optional engines (default: false)
#
# ─────────────────────────────────────────────────────────────────────────────

ARG PYTHON_VERSION=3.12


# ── Base: shared system dependencies ──────────────────────────────────────────
FROM python:${PYTHON_VERSION}-slim AS base

WORKDIR /app

RUN apt-get update && apt-get install -y --no-install-recommends \
        gcc \
        git \
    && rm -rf /var/lib/apt/lists/*

RUN pip install --upgrade pip --quiet


# ── Builder: install Python packages ──────────────────────────────────────────
FROM base AS builder

COPY requirements.txt .

RUN pip install \
        --prefix=/install \
        --no-cache-dir \
        -r requirements.txt


# ── Dev: development environment ──────────────────────────────────────────────
FROM base AS dev

LABEL org.opencontainers.image.title="Bawbel Scanner (dev)" \
      org.opencontainers.image.description="Development environment for bawbel-scanner"

COPY --from=builder /install /usr/local

RUN pip install --no-cache-dir \
        pytest \
        pytest-cov \
        pytest-mock \
        black \
        flake8 \
        flake8-bugbear \
        bandit \
        pre-commit \
        pip-audit \
        build \
        twine

COPY . /app

RUN pip install -e . --no-deps --quiet

ENV BAWBEL_LOG_LEVEL=DEBUG \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

VOLUME ["/scan"]

CMD ["/bin/bash"]


# ── Test: run test suite and exit ──────────────────────────────────────────────
FROM dev AS test

LABEL org.opencontainers.image.title="Bawbel Scanner (test)"

RUN python -m pytest tests/ -v --tb=short

CMD ["python", "-m", "pytest", "tests/", "-v", "--tb=short"]


# ── Production: minimal runtime image ─────────────────────────────────────────
FROM python:${PYTHON_VERSION}-slim AS production

ARG WITH_LLM=false
ARG WITH_SANDBOX=false
ARG WITH_ALL=false

LABEL org.opencontainers.image.title="Bawbel Scanner" \
      org.opencontainers.image.description="Agentic AI security scanner. Detects AVE vulnerabilities. Produces OWASP AIVSS v0.8 scores." \
      org.opencontainers.image.url="https://bawbel.io" \
      org.opencontainers.image.source="https://github.com/bawbel/scanner" \
      org.opencontainers.image.version="1.2.0" \
      org.opencontainers.image.licenses="Apache-2.0" \
      org.opencontainers.image.vendor="Bawbel" \
      org.opencontainers.image.documentation="https://bawbel.io/docs" \
      bawbel.aivss.spec="0.8" \
      bawbel.ave.records="45"

WORKDIR /app

COPY --from=builder /install /usr/local

COPY scanner/   ./scanner/
COPY config/    ./config/

RUN pip install --no-cache-dir click rich pydantic --quiet

# Optional engines - install only what is requested
RUN if [ "$WITH_ALL" = "true" ] || [ "$WITH_LLM" = "true" ]; then \
        pip install --no-cache-dir litellm --quiet; \
    fi

RUN if [ "$WITH_ALL" = "true" ] || [ "$WITH_SANDBOX" = "true" ]; then \
        apt-get update && apt-get install -y --no-install-recommends \
            libseccomp-dev \
        && rm -rf /var/lib/apt/lists/*; \
    fi

RUN useradd \
        --create-home \
        --shell /bin/bash \
        --uid 1000 \
        bawbel \
    && chown -R bawbel:bawbel /app

USER bawbel

VOLUME ["/scan"]

HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD python -c "from scanner import scan; print('ok')" || exit 1

ENTRYPOINT ["python", "-m", "scanner.cli"]

# Default: show help
# Override in docker run or docker-compose:
#   scan /scan --recursive
#   ssc https://server.example.com
#   conform https://server.example.com
#   pin /scan
#   aibom /scan
CMD ["--help"]