mirror of
https://github.com/Av0idD4rk/firegex.git
synced 2026-10-23 16:31:00 +00:00
66 lines
2.8 KiB
Docker
66 lines
2.8 KiB
Docker
|
|
# Firegex Dockerfile UUID signature
|
|
# cf1795af-3284-4183-a888-81ad3590ad84
|
|
# Needed for run.py to detect the Dockerfile
|
|
|
|
|
|
FROM --platform=$BUILDPLATFORM oven/bun AS frontend
|
|
WORKDIR /app
|
|
ADD ./frontend/package.json .
|
|
ADD ./frontend/bun.lock .
|
|
RUN bun i
|
|
COPY ./frontend/ .
|
|
COPY ./docs/*.md /docs/
|
|
RUN bun run build
|
|
|
|
# Base fedora container
|
|
FROM --platform=$TARGETARCH quay.io/fedora/fedora:44 AS base
|
|
# iproute: the proxy engine needs `ip rule`/`ip route` to bring the return traffic
|
|
# home when a service preserves the client's source address.
|
|
# iproute-tc: `tc` is a separate package from `ip` on Fedora, and it is what mirrors the
|
|
# decrypted traffic of every TLS service onto one capture interface. The kernel's own
|
|
# `dup to` in the netdev family would do the same without it, and is not used: it needs
|
|
# `nft_dup_netdev`, which plenty of kernels are built without, and the failure is a rule
|
|
# that will not load rather than a feature that degrades.
|
|
RUN dnf -y update && dnf install -y python3.14 libnetfilter_queue \
|
|
libnfnetlink libmnl libcap-ng-utils nftables iproute iproute-tc \
|
|
vectorscan libtins python3-nftables libpcap && dnf clean all
|
|
|
|
RUN mkdir -p /execute/modules
|
|
WORKDIR /execute
|
|
|
|
FROM --platform=$TARGETARCH base AS compiler
|
|
|
|
RUN dnf -y update && dnf install -y python3.14-devel @development-tools gcc-c++ \
|
|
libnetfilter_queue-devel libnfnetlink-devel libmnl-devel \
|
|
vectorscan-devel libtins-devel libpcap-devel boost-devel cargo
|
|
|
|
COPY ./backend/binsrc /execute/binsrc
|
|
RUN g++ binsrc/nfregex.cpp -o cppregex -std=c++23 -O3 -Wall -lnetfilter_queue -pthread -lnfnetlink $(pkg-config --cflags --libs libtins libhs libmnl)
|
|
RUN g++ binsrc/pyfilter.cpp -o cpproxy -std=c++23 -O3 -Wall -lnetfilter_queue -lpython3.14 -pthread -lnfnetlink $(pkg-config --cflags --libs libtins libmnl python3)
|
|
|
|
# The proxy datapath engine, built here rather than in a rust image on purpose: it
|
|
# links the same libhs the C++ binaries do, and a binary built against one distro's
|
|
# vectorscan and run against another's is a class of failure nobody would enjoy
|
|
# debugging at a competition.
|
|
COPY ./backend/proxysrc /execute/proxysrc
|
|
RUN cd /execute/proxysrc && cargo build --release
|
|
|
|
#Building main conteiner
|
|
FROM --platform=$TARGETARCH base AS final
|
|
|
|
COPY ./backend/requirements.txt /execute/requirements.txt
|
|
COPY ./fgex-lib /execute/fgex-lib
|
|
|
|
RUN dnf -y update && dnf install -y gcc-c++ python3.14-devel uv git &&\
|
|
uv pip install --no-cache --system ./fgex-lib &&\
|
|
uv pip install --no-cache --system -r /execute/requirements.txt &&\
|
|
uv cache clean && dnf remove -y gcc-c++ python3.14-devel uv git && dnf clean all
|
|
|
|
COPY ./backend/ /execute/
|
|
COPY --from=compiler /execute/cppregex /execute/cpproxy /execute/modules/
|
|
COPY --from=compiler /execute/proxysrc/target/release/fgex-proxy /execute/modules/
|
|
COPY --from=frontend /app/dist/ ./frontend/
|
|
|
|
CMD ["/bin/sh", "/execute/docker-entrypoint.sh"]
|