Dockerfile.django-debian

# code: language=Dockerfile

# The code for the build image should be identical with the code in
# Dockerfile.nginx to use the caching mechanism of Docker.

# Ref: https://devguide.python.org/#branchstatus
FROM python:3.14.8-slim-trixie@sha256:fbecd461fc72d21b2143c6eaba25143738079154a6d0ea3da3aec724f50eed4a AS base
FROM base AS build
WORKDIR /app
RUN \
  apt-get -y update && \
  apt-get -y upgrade && \
  apt-get -y install --no-install-recommends \
    gcc \
    build-essential \
    dnsutils \
    libpq-dev \
    postgresql-client \
    xmlsec1 \
    git \
    uuid-runtime \
    # libcurl4-openssl-dev is required for installing pycurl python package
    libcurl4-openssl-dev \
    && \
  apt-get clean && \
  rm -rf /var/lib/apt/lists && \
  true
COPY requirements.txt ./
# CPUCOUNT=1 is needed, otherwise the wheel for uwsgi won't always be build succesfully
# https://github.com/unbit/uwsgi/issues/1318#issuecomment-542238096
RUN export PYCURL_SSL_LIBRARY=openssl && \
    CPUCOUNT=1 pip3 wheel --wheel-dir=/tmp/wheels -r ./requirements.txt

FROM base AS release
WORKDIR /app
ARG uid=1001
ARG gid=1337
ARG appuser=defectdojo
ENV appuser=${appuser}
RUN \
  apt-get -y update && \
  apt-get -y upgrade && \
  # ugly fix to install postgresql-client without errors
  mkdir -p /usr/share/man/man1 /usr/share/man/man7 && \
  # ca-certificates + curl are needed to fetch the PostgreSQL APT (PGDG) signing key
  apt-get -y install --no-install-recommends ca-certificates curl && \
  # Debian trixie only ships postgresql-client-17, but the bundled PostgreSQL
  # server is 18. pg_dump refuses to dump a server newer than itself, which
  # breaks `manage.py dbbackup`, so pull the matching v18 client from PGDG.
  install -d /usr/share/postgresql-common/pgdg && \
  curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc && \
  echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt trixie-pgdg main" > /etc/apt/sources.list.d/pgdg.list && \
  apt-get -y update && \
  apt-get -y install --no-install-recommends \
    # libopenjp2-7 libjpeg62 are required by the pillow package
    libopenjp2-7 \
    libjpeg62 \
    dnsutils \
    xmlsec1 \
    git \
    uuid-runtime \
    libpq-dev \
    # only required for the dbshell (used by the initializer job) and dbbackup;
    # must match the server major version (18) for pg_dump to work
    postgresql-client-18 \
    # libcurl4-openssl-dev is required for installing pycurl python package
    libcurl4-openssl-dev \
    && \
  apt-get clean && \
  rm -rf /var/lib/apt/lists && \
  true
# Upgrade the system trust store and shared libraries in their own layer. Release
# builds reuse the layer above from the build cache, so an OS update to these
# packages (ca-certificates here after the eMudhra key compromise, 2026-10-20)
# would otherwise never reach the image.
# Bump OS_REFRESH to force this layer to rebuild for the next package update.
ARG OS_REFRESH=2026-10-28
RUN \
  echo "OS package refresh ${OS_REFRESH}" && \
  apt-get -y update && \
  apt-get -y install --no-install-recommends --only-upgrade ca-certificates libbrotli1 libbrotli-dev && \
  apt-get clean && \
  rm -rf /var/lib/apt/lists && \
  true
RUN \
  --mount=from=build,src=/tmp/wheels,target=/tmp/wheels \
  --mount=from=build,src=/app/requirements.txt,target=/app/requirements.txt \
  pip3 install \
	--no-cache-dir \
	--no-index \
  --find-links=/tmp/wheels \
  -r ./requirements.txt && \
  apt-get -y purge --auto-remove git
# Fail the build if either trust store still carries the root distrusted after the
# eMudhra key compromise (2026-10-20), so a cached or stale layer can't ship it.
RUN python3 -c "import ssl, sys, certifi; bad = [f for f in ('/etc/ssl/certs/ca-certificates.crt', certifi.where()) if (lambda ctx: ctx.load_verify_locations(cafile=f) or any(dict(x[0] for x in c['subject']).get('commonName') == 'emSign ECC Root CA - G3' for c in ctx.get_ca_certs()))(ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT))]; sys.exit('distrusted root emSign ECC Root CA - G3 still in: ' + ', '.join(bad) if bad else 0)"

COPY \
  docker/entrypoint-celery-beat.sh \
  docker/entrypoint-celery-worker.sh \
  docker/entrypoint-initializer.sh \
  docker/entrypoint-uwsgi.sh \
  docker/wait-for-it.sh \
  docker/secret-file-loader.sh \
  docker/reach_database.sh \
  docker/reach_broker.sh \
  docker/certs/* \
  /
COPY manage.py ./
COPY dojo/ ./dojo/

# Add extra fixtures to docker image which are loaded by the initializer
COPY docker/extra_fixtures/* /app/dojo/fixtures/

RUN \
  # Remove placeholder copied from docker/certs
  rm -f /readme.txt && \
  # Remove placeholder copied from docker/extra_fixtures
  rm -f dojo/fixtures/readme.txt && \
  mkdir -p dojo/migrations && \
  chmod g=u dojo/migrations && \
  true

# Compile translation catalogs (.mo) into the image (the .mo files are gitignored
# and generated at build). msgfmt is run directly so no Django settings/env are
# needed; gettext is only required at build time, so install and purge it here.
# Kept in the portable -exec form (not -execdir) so this stays identical to the
# alpine Dockerfile, whose BusyBox find has no -execdir.
RUN \
  apt-get -y update && \
  apt-get -y install --no-install-recommends gettext && \
  find dojo/locale -name 'django.po' -exec sh -c 'msgfmt "$1" -o "${1%.po}.mo"' _ {} \; && \
  apt-get -y purge --auto-remove gettext && \
  apt-get clean && \
  rm -rf /var/lib/apt/lists
USER root
RUN \
    addgroup --gid ${gid} ${appuser} && \
    adduser --system --no-create-home --disabled-password --gecos '' \
        --uid ${uid} --gid ${gid} ${appuser} && \
    chown -R root:root /app && \
    chmod -R u+rwX,go+rX,go-w /app && \
    # Allow for bind mounting local_settings.py and other setting overrides
    chown -R root:${appuser} /app/dojo/settings && \
    chmod -R 775 /app/dojo/settings && \
    mkdir /var/run/${appuser} && \
    chown ${appuser} /var/run/${appuser} && \
    chmod g=u /var/run/${appuser} && \
    chmod 775 /*.sh && \
    mkdir -p media/threat && chown -R ${uid} media && \
    # To avoid warning: (staticfiles.W004) The directory '/app/components/node_modules' in the STATICFILES_DIRS setting does not exist.
    mkdir -p components/node_modules && \
    chown ${appuser} components/node_modules
USER ${uid}
ENV \
  # Only variables that are not defined in settings.dist.py
  DD_ADMIN_USER=admin \
  DD_ADMIN_MAIL=admin@defectdojo.local \
  DD_ADMIN_PASSWORD='' \
  DD_ADMIN_FIRST_NAME=Admin \
  DD_ADMIN_LAST_NAME=User \
  DD_CELERY_LOG_LEVEL="INFO" \
  DD_CELERY_WORKER_POOL_TYPE="solo" \
  # Enable prefork and options below to ramp-up celeryworker performance. Presets should work fine for a machine with 8GB of RAM, while still leaving room.
  # See https://docs.celeryproject.org/en/stable/userguide/workers.html#id12 for more details
  # DD_CELERY_WORKER_POOL_TYPE="prefork" \
  # DD_CELERY_WORKER_AUTOSCALE_MIN="2" \
  # DD_CELERY_WORKER_AUTOSCALE_MAX="8" \
  # DD_CELERY_WORKER_CONCURRENCY="8" \
  # DD_CELERY_WORKER_PREFETCH_MULTIPLIER="128" \
  DD_INITIALIZE=true \
  DD_UWSGI_MODE="socket" \
  DD_UWSGI_ENDPOINT="0.0.0.0:3031" \
  DD_UWSGI_NUM_OF_PROCESSES="4" \
  DD_UWSGI_NUM_OF_THREADS="4"
ENTRYPOINT ["/entrypoint-uwsgi.sh"]

FROM release AS development
USER root
COPY \
  requirements-dev.txt \
  docker/unit-tests.sh \
  ./
COPY \
  docker/entrypoint-celery-worker-dev.sh \
  docker/entrypoint-uwsgi-dev.sh \
  docker/entrypoint-unit-tests.sh \
  docker/entrypoint-unit-tests-devDocker.sh \
  /
RUN pip3 install --no-cache-dir -r requirements-dev.txt && \
    chmod 775 /*.sh
USER ${uid}

FROM development AS django-unittests
COPY unittests/ ./unittests/
COPY tests/ ./tests/