irt/docker_zircolite
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Pin alpine:3.23, multi-stage runtime, smoke test, fix arg drift

Browse Source 
- Pin both stages to alpine:3.23 (was floating 'alpine').
- Multi-stage: separate runtime image without rust+cargo+sdk, just python3.
- venv for Python deps (PEP 668 on modern Alpine blocks system pip).
- start.sh: -c <fieldMappings.yaml> (was .json — upstream renamed),
  drop -t which now means --template (Jinja2) not tmpdir.
- test_smoke.sh: fetch Yamato sample-evtx on demand, scan, verify JSON
  + log produced, count Sigma rule hits.
- fetch-test-data.sh + .gitignore for test-data/.

Validated end-to-end on amd64 Linux: 5/5 PASS, 39 hits, Zircolite v3.6.3
with 2160 rules.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
tabledevil
2026-05-07 19:20:05 +02:00
parent 49cf6750fd
commit 7188d7b6bc
5 changed files with 104 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+23 -4
View File
@@ -1,12 +1,31 @@
FROM alpine as builder
FROM alpine:3.23 AS builder
LABEL maintainer="tabledevil"
RUN apk add --no-cache rust cargo python3 py3-pip alpine-sdk git bash
ENV PATH=/root/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
RUN git clone https://github.com/wagga40/Zircolite /opt/zircolite
# Always grab the current Zircolite master + rules at build time.
RUN git clone --depth=1 https://github.com/wagga40/Zircolite /opt/zircolite
ENV PYTHONDONTWRITEBYTECODE=1
ADD pip.conf /etc/pip.conf
RUN cd /opt/zircolite && pip install -r requirements.txt
# Use a venv: PEP 668 on modern Alpine blocks system-pip.
RUN python3 -m venv /opt/zircolite/venv \
&& /opt/zircolite/venv/bin/pip install -r /opt/zircolite/requirements.txt
WORKDIR /data
RUN mkdir /output && touch /output/notmounted
RUN python3 /opt/zircolite/zircolite.py -U --rules /opt/zircolite/rules/
# Refresh sigma rules to latest at build time.
RUN /opt/zircolite/venv/bin/python /opt/zircolite/zircolite.py -U --rules /opt/zircolite/rules/
ADD start.sh /root/start.sh
RUN chmod +x /root/start.sh
FROM alpine:3.23
RUN apk add --no-cache python3 bash
COPY --from=builder /opt/zircolite /opt/zircolite
COPY --from=builder /root/start.sh /root/start.sh
RUN mkdir -p /output && touch /output/notmounted
WORKDIR /data
CMD ["/bin/bash","/root/start.sh"]