feat(docker): decouple NestBot service with separate container

backend/pyproject.toml

@@ -14,7 +14,6 @@ packages = [ { include = "apps" } ]
 [tool.poetry.dependencies]
 algoliasearch = "^4.13.2"
 algoliasearch-django = "^4.0.0"
-crewai = { version = "^1.7.2", python = ">=3.10,<3.14" }
 django = "^6.0"
 django-configurations = "^2.5.1"
 django-cors-headers = "^4.7.0"
@@ -27,9 +26,6 @@ geopy = "^2.4.1"
 gunicorn = "^23.0.0"
 humanize = "^4.11.0"
 jinja2 = "^3.1.6"
-langchain = "^0.3.26"
-langchain-community = "^0.3.26"
-langgraph = "^1.0.1"
 lxml = "^6.0.0"
 markdown = "^3.7"
 openai = "~=1.83.0"
@@ -72,6 +68,12 @@ pillow = "^12.1.0"
 pypdfium2 = "^5.2.0"
 weasyprint = "^67.0"
 
+[tool.poetry.group.nestbot.dependencies]
+crewai = { version = "^1.7.2", python = ">=3.10,<3.14" }
+langchain = "^0.3.26"
+langchain-community = "^0.3.26"
+langgraph = "^1.0.1"
+
 [tool.ruff]
 target-version = "py313"
 

docker-compose/local/compose.yaml

@@ -4,7 +4,7 @@ services:
     command: >
       sh -c '
         python manage.py migrate &&
-        python manage.py runserver 0.0.0.0:8000
+        exec python manage.py runserver 0.0.0.0:8000
       '
     image: nest-local-backend
     build:
@@ -17,13 +17,23 @@ services:
         condition: service_healthy
     env_file: ../../backend/.env
     environment:
+      PYTHONUNBUFFERED: 1
       DJANGO_DB_HOST: ${DJANGO_DB_HOST:-db}
       DJANGO_DB_NAME: ${DJANGO_DB_NAME:-nest_db_dev}
       DJANGO_DB_PASSWORD: ${DJANGO_DB_PASSWORD:-nest_user_dev_password}
       DJANGO_DB_PORT: ${DJANGO_DB_PORT:-5432}
       DJANGO_DB_USER: ${DJANGO_DB_USER:-nest_user_dev}
       DJANGO_REDIS_HOST: ${DJANGO_REDIS_HOST:-nest-cache}
-      DJANGO_REDIS_PASSWORD: ${DJANGO_REDIS_HOST:-nest-cache-password}
+      DJANGO_REDIS_PASSWORD: ${DJANGO_REDIS_PASSWORD:-nest-cache-password}
+      # Disable Slack in backend - routes won't be registered
+      DJANGO_SLACK_BOT_TOKEN: None
+      DJANGO_SLACK_SIGNING_SECRET: None
+    healthcheck:
+      test: [CMD, curl, -f, http://localhost:8000/status/]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+      start_period: 60s
     networks:
       - nest-network
     ports:
@@ -32,6 +42,48 @@ services:
       - ../../backend:/home/owasp
       - backend-venv:/home/owasp/.venv
 
+  nestbot:
+    container_name: nest-nestbot
+    command: >
+      sh -c '
+        exec python manage.py runserver 0.0.0.0:8001
+      '
+    image: nest-local-nestbot
+    build:
+      context: ../../backend
+      dockerfile: ../docker/backend/Dockerfile.nestbot.local
+    depends_on:
+      backend:
+        condition: service_healthy
+      cache:
+        condition: service_healthy
+      db:
+        condition: service_healthy
+    env_file: ../../backend/.env
+    environment:
+      PYTHONUNBUFFERED: 1
+      DJANGO_DB_HOST: ${DJANGO_DB_HOST:-db}
+      DJANGO_DB_NAME: ${DJANGO_DB_NAME:-nest_db_dev}
+      DJANGO_DB_PASSWORD: ${DJANGO_DB_PASSWORD:-nest_user_dev_password}
+      DJANGO_DB_PORT: ${DJANGO_DB_PORT:-5432}
+      DJANGO_DB_USER: ${DJANGO_DB_USER:-nest_user_dev}
+      DJANGO_REDIS_HOST: ${DJANGO_REDIS_HOST:-nest-cache}
+      DJANGO_REDIS_PASSWORD: ${DJANGO_REDIS_PASSWORD:-nest-cache-password}
+      # Slack tokens inherited from .env file (not overridden here)
+    healthcheck:
+      test: [CMD, curl, -f, http://localhost:8001/status/]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+    networks:
+      - nest-network
+    ports:
+      - 8001:8001
+    volumes:
+      - ../../backend:/home/owasp
+      - nestbot-venv:/home/owasp/.venv
+
   cache:
     command: >
       sh -c '
@@ -80,7 +132,7 @@ services:
     networks:
       - nest-network
     ports:
-      - 8001:8001
+      - 8002:8001
     volumes:
       - ../../docs:/home/owasp/docs
       - docs-venv:/home/owasp/.venv
@@ -114,10 +166,10 @@ services:
       sh -c '
         python manage.py rqworker ai --with-scheduler
       '
-    image: nest-local-backend
+    image: nest-local-nestbot
     depends_on:
-      backend:
-        condition: service_started
+      nestbot:
+        condition: service_healthy
       cache:
         condition: service_healthy
       db:
@@ -129,13 +181,14 @@ services:
       DJANGO_DB_PASSWORD: ${DJANGO_DB_PASSWORD:-nest_user_dev_password}
       DJANGO_DB_PORT: ${DJANGO_DB_PORT:-5432}
       DJANGO_DB_USER: ${DJANGO_DB_USER:-nest_user_dev}
-      DJANGO_REDIS_HOST: ${DJANGO_REDIS_HOST:-cache}
+      DJANGO_REDIS_HOST: ${DJANGO_REDIS_HOST:-nest-cache}
       DJANGO_REDIS_PASSWORD: ${DJANGO_REDIS_PASSWORD:-nest-cache-password}
+      # Worker needs Slack tokens for SlackConfig.app.client (inherited from .env)
     networks:
       - nest-network
     volumes:
       - ../../backend:/home/owasp
-      - backend-venv:/home/owasp/.venv
+      - nestbot-venv:/home/owasp/.venv
 
 networks:
   nest-network:
@@ -147,3 +200,4 @@ volumes:
   docs-venv:
   frontend-next:
   frontend-node-modules:
+  nestbot-venv:

docker/backend/Dockerfile

@@ -33,7 +33,7 @@ USER owasp
 
 COPY --chmod=444 --chown=root:root poetry.lock pyproject.toml ./
 RUN --mount=type=cache,target=${POETRY_CACHE_DIR},uid=${OWASP_UID},gid=${OWASP_GID} \
-    poetry install --no-root --without dev --without test --without video
+    poetry install --no-root --without dev --without test --without video --without nestbot
 
 COPY apps apps
 COPY entrypoint.sh manage.py wsgi.py ./

docker/backend/Dockerfile.local

@@ -1,6 +1,5 @@
-# Docker Hardened Images (DHI) - requires: docker login dhi.io
-# Use -dev variant for builder stage (includes build tools and shell)
-FROM dhi.io/python:3.13-dev AS builder
+# python:slim is used as base image to keep the image size small
+FROM python:3.13-slim AS builder
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
@@ -15,6 +14,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         build-essential \
         libffi-dev \
         libssl-dev \
+        libpq-dev \
         passwd \
         && rm -rf /var/lib/apt/lists/* && \
     groupadd -g ${OWASP_GID} owasp && \
@@ -28,62 +28,37 @@ RUN --mount=type=cache,target=${PIP_CACHE_DIR} \
 USER owasp
 WORKDIR /home/owasp
 
-# Copy files as root first, then fix ownership and permissions
-USER root
-COPY --chown=${OWASP_UID}:${OWASP_GID} poetry.lock pyproject.toml ./
-RUN chmod 644 poetry.lock pyproject.toml
-
-USER owasp
-
-# Update lock file if pyproject.toml changed (e.g., Python version upgrade)
+COPY --chmod=444 --chown=root:root poetry.lock pyproject.toml ./
 RUN --mount=type=cache,target=${POETRY_CACHE_DIR},uid=${OWASP_UID},gid=${OWASP_GID} \
     --mount=type=cache,target=${PIP_CACHE_DIR} \
-    poetry install --no-root --without dev --without test --without video
+    poetry install --no-root --without dev --without test --without video --without nestbot
 
-# Use -dev variant for runtime stage to allow installing runtime dependencies
-# Still hardened, just includes shell and package manager for flexibility
-FROM dhi.io/python:3.13-dev
+# Runtime stage using python:slim
+FROM python:3.13-slim
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 ENV FORCE_COLOR=1 \
     PIP_CACHE_DIR="/home/owasp/.cache/pip" \
-    PATH="/home/owasp/.venv/bin:/usr/local/bin:$PATH" \
-    PYTHONPATH="/home/owasp:/home/owasp/.venv/lib/python3.13/site-packages" \
-    VIRTUAL_ENV="/home/owasp/.venv" \
+    PATH="/home/owasp/.venv/bin:$PATH" \
     PYTHONUNBUFFERED=1
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
         postgresql-client \
+        libpq5 \
         passwd \
         curl \
         && rm -rf /var/lib/apt/lists/* && \
     groupadd -g 1000 owasp && \
     useradd -u 1000 -g owasp -m -s /bin/bash owasp
 
-# Install poetry for runtime (needed for volume-based development setup)
-RUN --mount=type=cache,target=/root/.cache/pip \
-    python3 -m pip install poetry --cache-dir /root/.cache/pip
+RUN --mount=type=cache,target=${PIP_CACHE_DIR} \
+    python -m pip install poetry --cache-dir ${PIP_CACHE_DIR}
 
 EXPOSE 8000
 
 USER owasp
 WORKDIR /home/owasp
 
 COPY --from=builder --chmod=555 --chown=root:root /home/owasp /home/owasp
-
-# Fix ownership and permissions for volume compatibility
-# Also backup .venv to /tmp for volume initialization
-USER root
-RUN if [ -d /home/owasp/.venv ]; then \
-        chown -R 1000:1000 /home/owasp/.venv && \
-        chmod -R u+w /home/owasp/.venv && \
-        cp -r /home/owasp/.venv /tmp/.venv-backup && \
-        chown -R 1000:1000 /tmp/.venv-backup; \
-    fi && \
-    mkdir -p /home/owasp/.local/share && \
-    chown -R 1000:1000 /home/owasp/.local && \
-    chmod -R u+w /home/owasp/.local
-
-USER owasp

docker/backend/Dockerfile.nestbot.local

@@ -0,0 +1,64 @@
+# python:slim is used as base image to keep the image size small
+FROM python:3.13.7-slim AS builder
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+ENV OWASP_GID=1000 \
+    OWASP_UID=1000 \
+    PIP_CACHE_DIR="/home/owasp/.cache/pip" \
+    POETRY_CACHE_DIR="/home/owasp/.cache/pypoetry" \
+    POETRY_VIRTUALENVS_IN_PROJECT=true \
+    PYTHONUNBUFFERED=1
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential \
+        libffi-dev \
+        libssl-dev \
+        libpq-dev \
+        passwd \
+        && rm -rf /var/lib/apt/lists/* && \
+    groupadd -g ${OWASP_GID} owasp && \
+    useradd -u ${OWASP_UID} -g owasp -m -s /bin/bash owasp && \
+    mkdir -p ${POETRY_CACHE_DIR} /home/owasp/.local/share && \
+    chown -R owasp:owasp /home/owasp
+
+RUN --mount=type=cache,target=${PIP_CACHE_DIR} \
+    python -m pip install poetry --cache-dir ${PIP_CACHE_DIR}
+
+USER owasp
+WORKDIR /home/owasp
+
+COPY --chmod=444 --chown=root:root poetry.lock pyproject.toml ./
+RUN --mount=type=cache,target=${POETRY_CACHE_DIR},uid=${OWASP_UID},gid=${OWASP_GID} \
+    --mount=type=cache,target=${PIP_CACHE_DIR} \
+    poetry install --no-root --without dev --without test --without video
+
+# Runtime stage using python:slim
+FROM python:3.13-slim
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+ENV FORCE_COLOR=1 \
+    PIP_CACHE_DIR="/home/owasp/.cache/pip" \
+    PATH="/home/owasp/.venv/bin:$PATH" \
+    PYTHONUNBUFFERED=1
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        postgresql-client \
+        libpq5 \
+        passwd \
+        curl \
+        && rm -rf /var/lib/apt/lists/* && \
+    groupadd -g 1000 owasp && \
+    useradd -u 1000 -g owasp -m -s /bin/bash owasp
+
+RUN --mount=type=cache,target=${PIP_CACHE_DIR} \
+    python -m pip install poetry --cache-dir ${PIP_CACHE_DIR}
+
+EXPOSE 8001
+
+USER owasp
+WORKDIR /home/owasp
+
+COPY --from=builder --chmod=555 --chown=root:root /home/owasp /home/owasp