aibom-security/docker-compose.yml at main · RedHatResearch/aibom-security · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
# Architecture PoC stack (local laptop only). See README for host verify steps.
# Credentials are local-only defaults; data is ephemeral (no named volumes).

x-proxy-env: &proxy-env
  AIBOM_STORE: proxy
  AIBOM_PG_DSN: postgresql://aibom:aibom@postgres:5432/aibom
  AIBOM_MINIO_ENDPOINT: minio:9000
  AIBOM_MINIO_ACCESS_KEY: minioadmin
  AIBOM_MINIO_SECRET_KEY: minioadmin
  AIBOM_MINIO_BUCKET: aibom-artifacts
  AIBOM_MINIO_SECURE: "0"
  AIBOM_REDIS_URL: redis://redis:6379/0

x-app: &app
  image: aibom-security:local
  build: .

services:
  postgres:
    image: postgres:16
    environment:
      POSTGRES_USER: aibom
      POSTGRES_PASSWORD: aibom
      POSTGRES_DB: aibom
    ports:
      - "127.0.0.1:5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U aibom -d aibom"]
      interval: 5s
      timeout: 5s
      retries: 10

  minio:
    image: minio/minio:RELEASE.2025-04-22T22-12-26Z
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    ports:
      - "127.0.0.1:9000:9000"
      - "127.0.0.1:9001:9001"

  minio-init:
    image: minio/mc:RELEASE.2025-04-16T18-13-26Z
    depends_on:
      - minio
    restart: "no"
    entrypoint: >
      /bin/sh -c "
      i=0;
      until mc alias set local http://minio:9000 minioadmin minioadmin; do
        i=$$((i+1));
        if [ $$i -ge 60 ]; then
          echo 'minio-init: MinIO not ready after 60s' >&2;
          exit 1;
        fi;
        sleep 1;
      done;
      mc mb --ignore-existing local/aibom-artifacts;
      "

  redis:
    image: redis:7
    ports:
      - "127.0.0.1:6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10

  worker:
    <<: *app
    restart: unless-stopped
    entrypoint: ["python", "-m", "aibom_verifier.worker"]
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    environment:
      <<: *proxy-env
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio-init:
        condition: service_completed_successfully

  sweeper:
    <<: *app
    restart: unless-stopped
    # Daily loop; --store proxy + --max-age-days 30 are explicit for the PoC.
    entrypoint:
      - /bin/sh
      - -c
      - >-
        while true; do
        aibom cache-sweep --store proxy --max-age-days 30
        || echo "cache-sweep failed: $$?" >&2;
        sleep 86400;
        done
    environment:
      <<: *proxy-env
    depends_on:
      postgres:
        condition: service_healthy
      minio-init:
        condition: service_completed_successfully