zhaolei
16f134e328
核心功能: - 6 层检测管线: L0 结构分析 → L1 ClamAV → L2 文档深度检测 → L3 关键词匹配 → L4 YARA → L5 PE/二进制 - FastAPI + PostgreSQL + Redis + Docker Compose 架构 - 客户端 HMAC-SHA256 签名鉴权 + 限流 + 幂等性 - 控制台 UI (登录/Dashboard/诊断中心/策略管理/任务列表/测试中心/产品介绍页) - 三层诊断定时器 (error_scan 30s / db_aggregate 30s / container_check 5min) 并发与稳定性修复: - 诊断定时器 Redis 时间槽位锁 (多 worker 同一槽位只有一个执行) - JSONL 存储 fcntl 跨进程排他锁 + 容错解码 + 原子重写 - 移除 SQLite fallback, 统一 PostgreSQL - API_CLIENTS 脱敏为环境变量, .env 已 .gitignore
54 lines
1.6 KiB
Docker
54 lines
1.6 KiB
Docker
# ---- 构建阶段 ----
|
||
FROM python:3.12-slim AS builder
|
||
|
||
WORKDIR /app
|
||
|
||
# 系统依赖：python-magic、ClamAV 客户端、编译工具
|
||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||
libmagic1 libmagic-dev \
|
||
clamav clamav-daemon \
|
||
&& rm -rf /var/lib/apt/lists/*
|
||
|
||
COPY requirements.txt .
|
||
RUN pip install --no-cache-dir -r requirements.txt
|
||
|
||
# ---- 运行阶段 ----
|
||
FROM python:3.12-slim
|
||
|
||
WORKDIR /app
|
||
|
||
# 系统运行时依赖
|
||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||
libmagic1 clamav clamav-daemon ca-certificates \
|
||
&& rm -rf /var/lib/apt/lists/* \
|
||
&& groupadd -r meshsafe && useradd -r -g meshsafe -d /app meshsafe
|
||
|
||
COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
|
||
COPY --from=builder /usr/local/bin /usr/local/bin
|
||
|
||
# 应用代码
|
||
COPY app/ ./app/
|
||
COPY config/policy.yaml ./config/policy.yaml
|
||
COPY config/diagnostics.yaml ./config/diagnostics.yaml
|
||
COPY scripts/ ./scripts/
|
||
COPY static/ ./static/
|
||
COPY tests/ ./tests/
|
||
|
||
# 日志目录、临时目录
|
||
RUN mkdir -p /var/log/meshsafe /tmp/meshsafe /app/rules \
|
||
&& chown -R meshsafe:meshsafe /app /var/log/meshsafe /tmp/meshsafe
|
||
|
||
ENV PYTHONUNBUFFERED=1 \
|
||
PYTHONDONTWRITEBYTECODE=1 \
|
||
MESHSAFE_LOG_DIR=/var/log/meshsafe \
|
||
MESHSAFE_TEMP_ROOT=/tmp/meshsafe
|
||
|
||
USER meshsafe
|
||
|
||
EXPOSE 8443
|
||
|
||
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
||
CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8443/api/v1/health', timeout=3).read()" || exit 1
|
||
|
||
CMD ["sh", "-c", "uvicorn app.main:app --host 0.0.0.0 --port 8443 --workers ${UVICORN_WORKERS:-1}"]
|