Skip to content

feat(docker): decouple NestBot service with separate container #3939

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
arkid15r merged 15 commits into from
Feb 28, 2026
Merged

feat(docker): decouple NestBot service with separate container #3939

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
5b83548
feat(docker): decouple NestBot service with separate container (#3865)
Ani07-05 Feb 14, 2026
f1c4a57
coderabbit suggestions
Ani07-05 Feb 14, 2026
faa45dc
fix(docker): address CodeRabbit review suggestions and improve servic…
Ani07-05 Feb 14, 2026
a956b96
coderabbit and cubic dev suggestions
Ani07-05 Feb 14, 2026
8391621
add NestBot service with dedicated Dockerfile and update dependencies
Ani07-05 Feb 18, 2026
a09d9ab
coderabbit suggestions
Ani07-05 Feb 18, 2026
4c5e926
Lazy load AI imports, commit poetry.lock, revert healthcheck
Ani07-05 Feb 23, 2026
0640077
Update code
rudransh-shrivastava Feb 25, 2026
7c2dd9a
remove langchain, langchain-community, and langgraph
rudransh-shrivastava Feb 25, 2026
6986ee0
Update code
rudransh-shrivastava Feb 25, 2026
c67cb5a
add nestbot to clean-backend-docker
rudransh-shrivastava Feb 25, 2026
f35cc5e
Update code
rudransh-shrivastava Feb 25, 2026
4d32506
Update code
rudransh-shrivastava Feb 25, 2026
afeb675
use exec-nestbot-command
rudransh-shrivastava Feb 25, 2026
90c1b9e
fix tests
rudransh-shrivastava Feb 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 55 additions & 5 deletions docker-compose/local/compose.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ services:
command: >
sh -c '
python manage.py migrate &&
python manage.py runserver 0.0.0.0:8000
exec python manage.py runserver 0.0.0.0:8000
'
image: nest-local-backend
build:
Expand All @@ -17,13 +17,23 @@ services:
condition: service_healthy
env_file: ../../backend/.env
environment:
PYTHONUNBUFFERED: 1
DJANGO_DB_HOST: ${DJANGO_DB_HOST:-db}
DJANGO_DB_NAME: ${DJANGO_DB_NAME:-nest_db_dev}
DJANGO_DB_PASSWORD: ${DJANGO_DB_PASSWORD:-nest_user_dev_password}
DJANGO_DB_PORT: ${DJANGO_DB_PORT:-5432}
DJANGO_DB_USER: ${DJANGO_DB_USER:-nest_user_dev}
DJANGO_REDIS_HOST: ${DJANGO_REDIS_HOST:-nest-cache}
DJANGO_REDIS_PASSWORD: ${DJANGO_REDIS_HOST:-nest-cache-password}
DJANGO_REDIS_PASSWORD: ${DJANGO_REDIS_PASSWORD:-nest-cache-password}
# Disable Slack in backend - routes won't be registered
DJANGO_SLACK_BOT_TOKEN: None
DJANGO_SLACK_SIGNING_SECRET: None
Comment thread
Ani07-05 marked this conversation as resolved.
Outdated
healthcheck:
test: ["CMD", "python", "manage.py", "check"]
Comment thread
cubic-dev-ai[bot] marked this conversation as resolved.
Outdated
interval: 5s
Comment thread
Ani07-05 marked this conversation as resolved.
Outdated
timeout: 5s
retries: 20
start_period: 60s
Comment thread
Ani07-05 marked this conversation as resolved.
Outdated
networks:
- nest-network
ports:
Expand All @@ -32,6 +42,45 @@ services:
- ../../backend:/home/owasp
- backend-venv:/home/owasp/.venv

nestbot:
container_name: nest-nestbot
command: >
sh -c '
exec python manage.py runserver 0.0.0.0:8001
'
image: nest-local-backend
depends_on:
backend:
condition: service_healthy
cache:
condition: service_healthy
db:
condition: service_healthy
env_file: ../../backend/.env
environment:
PYTHONUNBUFFERED: 1
DJANGO_DB_HOST: ${DJANGO_DB_HOST:-db}
DJANGO_DB_NAME: ${DJANGO_DB_NAME:-nest_db_dev}
DJANGO_DB_PASSWORD: ${DJANGO_DB_PASSWORD:-nest_user_dev_password}
DJANGO_DB_PORT: ${DJANGO_DB_PORT:-5432}
DJANGO_DB_USER: ${DJANGO_DB_USER:-nest_user_dev}
DJANGO_REDIS_HOST: ${DJANGO_REDIS_HOST:-nest-cache}
DJANGO_REDIS_PASSWORD: ${DJANGO_REDIS_PASSWORD:-nest-cache-password}
# Slack tokens inherited from .env file (not overridden here)
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:8001/status/"]
interval: 5s
timeout: 5s
retries: 10
start_period: 30s
networks:
- nest-network
ports:
- 8001:8001
volumes:
- ../../backend:/home/owasp
- backend-venv:/home/owasp/.venv

cache:
command: >
sh -c '
Expand Down Expand Up @@ -80,7 +129,7 @@ services:
networks:
- nest-network
ports:
- 8001:8001
- 8002:8001
volumes:
- ../../docs:/home/owasp/docs
- docs-venv:/home/owasp/.venv
Expand Down Expand Up @@ -117,7 +166,7 @@ services:
image: nest-local-backend
depends_on:
backend:
condition: service_started
condition: service_healthy
cache:
condition: service_healthy
db:
Expand All @@ -129,8 +178,9 @@ services:
DJANGO_DB_PASSWORD: ${DJANGO_DB_PASSWORD:-nest_user_dev_password}
DJANGO_DB_PORT: ${DJANGO_DB_PORT:-5432}
DJANGO_DB_USER: ${DJANGO_DB_USER:-nest_user_dev}
DJANGO_REDIS_HOST: ${DJANGO_REDIS_HOST:-cache}
DJANGO_REDIS_HOST: ${DJANGO_REDIS_HOST:-nest-cache}
DJANGO_REDIS_PASSWORD: ${DJANGO_REDIS_PASSWORD:-nest-cache-password}
# Worker needs Slack tokens for SlackConfig.app.client (inherited from .env)
networks:
- nest-network
volumes:
Expand Down
45 changes: 10 additions & 35 deletions docker/backend/Dockerfile.local
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
# Docker Hardened Images (DHI) - requires: docker login dhi.io
# Use -dev variant for builder stage (includes build tools and shell)
FROM dhi.io/python:3.13-dev AS builder
# python:slim is used as base image to keep the image size small

@arkid15r arkid15r Feb 28, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we don't need backend image to be based on python slim for NestBot I'd prefer to keep it based on alpine.

FROM python:3.13-slim AS builder
Comment thread
Ani07-05 marked this conversation as resolved.
Outdated

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

Expand All @@ -15,6 +14,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
build-essential \
libffi-dev \
libssl-dev \
libpq-dev \
passwd \
&& rm -rf /var/lib/apt/lists/* && \
groupadd -g ${OWASP_GID} owasp && \
Expand All @@ -28,62 +28,37 @@ RUN --mount=type=cache,target=${PIP_CACHE_DIR} \
USER owasp
WORKDIR /home/owasp

# Copy files as root first, then fix ownership and permissions
USER root
COPY --chown=${OWASP_UID}:${OWASP_GID} poetry.lock pyproject.toml ./
RUN chmod 644 poetry.lock pyproject.toml

USER owasp

# Update lock file if pyproject.toml changed (e.g., Python version upgrade)
COPY --chmod=444 --chown=root:root poetry.lock pyproject.toml ./
RUN --mount=type=cache,target=${POETRY_CACHE_DIR},uid=${OWASP_UID},gid=${OWASP_GID} \
--mount=type=cache,target=${PIP_CACHE_DIR} \
poetry install --no-root --without dev --without test --without video

# Use -dev variant for runtime stage to allow installing runtime dependencies
# Still hardened, just includes shell and package manager for flexibility
FROM dhi.io/python:3.13-dev
# Runtime stage using python:slim
FROM python:3.13-slim

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

ENV FORCE_COLOR=1 \
PIP_CACHE_DIR="/home/owasp/.cache/pip" \
PATH="/home/owasp/.venv/bin:/usr/local/bin:$PATH" \
PYTHONPATH="/home/owasp:/home/owasp/.venv/lib/python3.13/site-packages" \
VIRTUAL_ENV="/home/owasp/.venv" \
PATH="/home/owasp/.venv/bin:$PATH" \
PYTHONUNBUFFERED=1

RUN apt-get update && \
apt-get install -y --no-install-recommends \
postgresql-client \
libpq5 \
passwd \
curl \
&& rm -rf /var/lib/apt/lists/* && \
groupadd -g 1000 owasp && \
useradd -u 1000 -g owasp -m -s /bin/bash owasp

# Install poetry for runtime (needed for volume-based development setup)
RUN --mount=type=cache,target=/root/.cache/pip \
python3 -m pip install poetry --cache-dir /root/.cache/pip
RUN --mount=type=cache,target=${PIP_CACHE_DIR} \
python -m pip install poetry --cache-dir ${PIP_CACHE_DIR}

EXPOSE 8000

USER owasp
WORKDIR /home/owasp

COPY --from=builder --chmod=555 --chown=root:root /home/owasp /home/owasp

# Fix ownership and permissions for volume compatibility
# Also backup .venv to /tmp for volume initialization
USER root
RUN if [ -d /home/owasp/.venv ]; then \
chown -R 1000:1000 /home/owasp/.venv && \
chmod -R u+w /home/owasp/.venv && \
cp -r /home/owasp/.venv /tmp/.venv-backup && \
chown -R 1000:1000 /tmp/.venv-backup; \
fi && \
mkdir -p /home/owasp/.local/share && \
chown -R 1000:1000 /home/owasp/.local && \
chmod -R u+w /home/owasp/.local

USER owasp