docker-compose.yml

# ── Bawbel Scanner - docker-compose.yml ───────────────────────────────────────
#
# Version: 1.3.0
#
# Usage examples:
#
#   Development shell:
#     docker compose --profile dev up dev
#
#   Run full test suite:
#     docker compose --profile test run --rm test
#
#   Scan a local skills directory (text output):
#     SCAN_DIR=./skills docker compose run --rm scan
#
#   Scan MCP server manifest (never starts the server):
#     MCP_URL=https://server.example.com docker compose run --rm ssc
#
#   Conformance check:
#     MCP_URL=https://server.example.com docker compose run --rm conform
#
#   AIBOM (AI Bill of Materials):
#     SCAN_DIR=./skills docker compose run --rm aibom
#
#   Pin skill files (rug pull protection):
#     SCAN_DIR=./skills docker compose run --rm pin
#
#   Check pins for drift:
#     SCAN_DIR=./skills docker compose run --rm check-pins
#
#   JSON output:
#     SCAN_DIR=./skills docker compose run --rm scan-json
#
#   SARIF output (GitHub Security upload):
#     SCAN_DIR=./skills docker compose run --rm scan-sarif
#
#   Full security audit of scanner codebase:
#     docker compose --profile audit run --rm audit
#
# ─────────────────────────────────────────────────────────────────────────────

x-base: &base
  build:
    context: .
    dockerfile: Dockerfile
  environment:
    BAWBEL_LOG_LEVEL:        ${BAWBEL_LOG_LEVEL:-WARNING}
    BAWBEL_LLM_MODEL:        ${BAWBEL_LLM_MODEL:-}
    BAWBEL_LLM_ENABLED:      ${BAWBEL_LLM_ENABLED:-false}
    ANTHROPIC_API_KEY:       ${ANTHROPIC_API_KEY:-}
    OPENAI_API_KEY:          ${OPENAI_API_KEY:-}
    GEMINI_API_KEY:          ${GEMINI_API_KEY:-}
    MISTRAL_API_KEY:         ${MISTRAL_API_KEY:-}
    GROQ_API_KEY:            ${GROQ_API_KEY:-}
    PYTHONDONTWRITEBYTECODE: "1"
    PYTHONUNBUFFERED:        "1"

x-scan-base: &scan-base
  <<: *base
  build:
    context: .
    dockerfile: Dockerfile
    target: production
  volumes:
    - ${SCAN_DIR:-./scan}:/scan:ro
  read_only: true
  security_opt:
    - no-new-privileges:true

x-ssc-base: &ssc-base
  <<: *base
  build:
    context: .
    dockerfile: Dockerfile
    target: production
  read_only: true
  security_opt:
    - no-new-privileges:true


services:

  # ── Development shell ──────────────────────────────────────────────────────
  dev:
    <<: *base
    build:
      context: .
      dockerfile: Dockerfile
      target: dev
    container_name: bawbel-dev
    volumes:
      - .:/app
      - pip-cache:/root/.cache/pip
    environment:
      BAWBEL_LOG_LEVEL: DEBUG
      PYTHONDONTWRITEBYTECODE: "1"
      PYTHONUNBUFFERED: "1"
    stdin_open: true
    tty: true
    entrypoint: /bin/bash
    profiles:
      - dev

  # ── Test runner ────────────────────────────────────────────────────────────
  test:
    <<: *base
    build:
      context: .
      dockerfile: Dockerfile
      target: test
    container_name: bawbel-test
    entrypoint: python
    command:
      - -m
      - pytest
      - tests/
      - -v
      - --tb=short
    profiles:
      - test

  # ── Scan: text output (default) ────────────────────────────────────────────
  scan:
    <<: *scan-base
    container_name: bawbel-scan
    entrypoint: ["python", "-m", "scanner.cli"]
    command:
      - scan
      - /scan
      - --recursive

  # ── Scan: JSON output ──────────────────────────────────────────────────────
  scan-json:
    <<: *scan-base
    container_name: bawbel-scan-json
    entrypoint: ["python", "-m", "scanner.cli"]
    command:
      - scan
      - /scan
      - --recursive
      - --format
      - json
    profiles:
      - json

  # ── Scan: SARIF output (GitHub Security / GHAS) ────────────────────────────
  scan-sarif:
    <<: *scan-base
    container_name: bawbel-scan-sarif
    volumes:
      - ${SCAN_DIR:-./scan}:/scan:ro
      - ${REPORT_DIR:-./reports}:/reports
    entrypoint: ["python", "-m", "scanner.cli"]
    command:
      - scan
      - /scan
      - --recursive
      - --format
      - sarif
      - --output
      - /reports/bawbel.sarif
    profiles:
      - sarif

  # ── SSC: scan MCP server manifest (never starts the server) ────────────────
  # Usage: MCP_URL=https://server.example.com docker compose run --rm ssc
  ssc:
    <<: *ssc-base
    container_name: bawbel-ssc
    entrypoint: ["python", "-m", "scanner.cli"]
    command:
      - ssc
      - ${MCP_URL:-https://example.com}

  # ── Conform: MCP server conformance grading (A+ to F) ─────────────────────
  # Usage: MCP_URL=https://server.example.com docker compose run --rm conform
  conform:
    <<: *ssc-base
    container_name: bawbel-conform
    entrypoint: ["python", "-m", "scanner.cli"]
    command:
      - conform
      - ${MCP_URL:-https://example.com}

  # ── AIBOM: AI Bill of Materials ────────────────────────────────────────────
  # Usage: SCAN_DIR=./skills docker compose run --rm aibom
  aibom:
    <<: *scan-base
    container_name: bawbel-aibom
    volumes:
      - ${SCAN_DIR:-./scan}:/scan:ro
      - ${REPORT_DIR:-./reports}:/reports
    entrypoint: ["python", "-m", "scanner.cli"]
    command:
      - aibom
      - /scan
      - --output
      - /reports/aibom.json
    profiles:
      - aibom

  # ── Pin: record skill file hashes for rug pull detection ──────────────────
  # Usage: SCAN_DIR=./skills docker compose run --rm pin
  pin:
    <<: *base
    build:
      context: .
      dockerfile: Dockerfile
      target: production
    container_name: bawbel-pin
    volumes:
      - ${SCAN_DIR:-./scan}:/scan
    entrypoint: ["python", "-m", "scanner.cli"]
    command:
      - pin
      - /scan
    profiles:
      - pin

  # ── Check-pins: detect drift from pinned hashes ────────────────────────────
  # Usage: SCAN_DIR=./skills docker compose run --rm check-pins
  check-pins:
    <<: *scan-base
    container_name: bawbel-check-pins
    entrypoint: ["python", "-m", "scanner.cli"]
    command:
      - check-pins
      - /scan
    profiles:
      - pins

  # ── Report: full remediation guide ────────────────────────────────────────
  report:
    <<: *scan-base
    container_name: bawbel-report
    entrypoint: ["python", "-m", "scanner.cli"]
    command:
      - report
      - /scan
    profiles:
      - report

  # ── PiranhaDB: local threat intel API for offline development ─────────────
  # Mirrors api.piranha.bawbel.io locally. No network calls from scanner.
  piranha:
    image: bawbel/piranha-api:latest
    container_name: bawbel-piranha
    ports:
      - "8000:8000"
    environment:
      - PIRANHA_RECORDS_DIR=/app/records
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 10s
      timeout: 5s
      retries: 3
    profiles:
      - dev
      - offline

  # ── Security audit ─────────────────────────────────────────────────────────
  audit:
    <<: *base
    build:
      context: .
      dockerfile: Dockerfile
      target: dev
    container_name: bawbel-audit
    entrypoint: /bin/bash
    command:
      - -c
      - |
        echo "=== Bandit ===" && \
        bandit -r scanner/ -f screen && \
        echo "" && \
        echo "=== pip-audit ===" && \
        pip-audit -r requirements.txt
    profiles:
      - audit


volumes:
  pip-cache: