logguardian/docker-compose.yml at main · zsoftly/logguardian · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
version: '3.8'

services:
  # Main LogGuardian container service
  logguardian:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        VERSION: ${VERSION:-1.3.0}
    image: logguardian:${VERSION:-latest}
    container_name: logguardian-container
    environment:
      # AWS Configuration
      AWS_REGION: ${AWS_REGION:-us-east-1}
      AWS_PROFILE: ${AWS_PROFILE:-default}
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY}
      AWS_SESSION_TOKEN: ${AWS_SESSION_TOKEN}

      # Application Configuration
      CONFIG_RULE_NAME: ${CONFIG_RULE_NAME:-cloudwatch-log-group-encrypted}
      BATCH_SIZE: ${BATCH_SIZE:-10}
      DRY_RUN: ${DRY_RUN:-true}

      # Logging
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    volumes:
      # Mount AWS credentials (read-only)
      - ~/.aws:/home/logguardian/.aws:ro
    command: [
      "--config-rule", "${CONFIG_RULE_NAME:-cloudwatch-log-group-encrypted}",
      "--region", "${AWS_REGION:-us-east-1}",
      "--batch-size", "${BATCH_SIZE:-10}",
      "--dry-run",
      "--verbose",
      "--output", "json"
    ]
    networks:
      - logguardian-net
    # Container exits after execution
    restart: "no"

  # Development container with shell access
  logguardian-dev:
    build:
      context: .
      dockerfile: Dockerfile
      target: builder
    image: logguardian:dev
    container_name: logguardian-dev
    environment:
      AWS_REGION: ${AWS_REGION:-us-east-1}
      AWS_PROFILE: ${AWS_PROFILE:-default}
    volumes:
      - ~/.aws:/root/.aws:ro
      - .:/workspace
    working_dir: /workspace
    command: /bin/sh
    networks:
      - logguardian-net
    stdin_open: true
    tty: true

  # Test runner container
  logguardian-test:
    build:
      context: .
      dockerfile: Dockerfile
      target: builder
    image: logguardian:test
    container_name: logguardian-test
    volumes:
      - .:/workspace
    working_dir: /workspace
    command: go test -v ./...
    networks:
      - logguardian-net

networks:
  logguardian-net:
    driver: bridge

# Usage examples:
#
# 1. Run in dry-run mode (default):
#    docker-compose up logguardian
#
# 2. Run with specific config rule:
#    CONFIG_RULE_NAME=my-rule docker-compose up logguardian
#
# 3. Run in apply mode (actual remediation):
#    DRY_RUN=false docker-compose up logguardian
#
# 4. Run tests:
#    docker-compose up logguardian-test
#
# 5. Access development shell:
#    docker-compose run logguardian-dev
#
# 6. Build all images:
#    docker-compose build
#
# 7. Clean up:
#    docker-compose down -v --rmi all