docker-compose.yml

# AutoPiff Docker Compose (standalone / GitHub)
# Full pipeline: MWDB + Karton + AutoPiff services
#
# NOTE: If you also run driver_analyzer/, new services must be added there too.
#       See ../driver_analyzer/docker-compose.yml for the production stack.
#
# Usage:
#   docker-compose up -d              # Start all services
#   docker-compose logs -f autopiff-patch-differ  # Follow logs
#   docker-compose down               # Stop all services

services:
  # ==========================================================================
  # Infrastructure: MWDB (Malware Database)
  # ==========================================================================

  mwdb-postgres:
    image: postgres:14-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: mwdb
      POSTGRES_USER: mwdb
      POSTGRES_PASSWORD: mwdb
    volumes:
      - mwdb-postgres-data:/var/lib/postgresql/data
    networks:
      - mwdb-internal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U mwdb"]
      interval: 10s
      timeout: 5s
      retries: 5

  mwdb-redis:
    image: redis:7-alpine
    restart: unless-stopped
    networks:
      - mwdb-internal
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  mwdb-core:
    image: certpl/mwdb@sha256:06750a582ac68662347c75b17b257ddeef0b6f09040431fee3d18c6198b8b58c
    restart: unless-stopped
    depends_on:
      mwdb-postgres:
        condition: service_healthy
      mwdb-redis:
        condition: service_healthy
    environment:
      MWDB_POSTGRES_URI: postgresql://mwdb:mwdb@mwdb-postgres/mwdb
      MWDB_REDIS_URI: redis://mwdb-redis
      MWDB_SECRET_KEY: ${MWDB_SECRET_KEY:-change-me-in-production}
      MWDB_ADMIN_LOGIN: admin
      MWDB_ADMIN_PASSWORD: ${MWDB_ADMIN_PASSWORD:-admin}
    ports:
      - "8080:8080"
    volumes:
      - mwdb-uploads:/app/uploads
    networks:
      - mwdb-internal
      - karton
      - frontend
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/api/ping"]
      interval: 30s
      timeout: 10s
      retries: 5

  # ==========================================================================
  # Infrastructure: Karton (Task Queue)
  # ==========================================================================

  karton-redis:
    image: redis:7-alpine
    restart: unless-stopped
    networks:
      - karton
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  minio:
    image: minio/minio:RELEASE.2024-01-01T16-36-33Z
    restart: unless-stopped
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
    ports:
      - "9000:9000"
      - "9001:9001"
    volumes:
      - minio-data:/data
    networks:
      - karton
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 30s
      timeout: 10s
      retries: 5

  karton-system:
    image: certpl/karton-system@sha256:dbf670d3be2df712ca643ac3c5acc9dcf72d490c87d0865ea74bf14a266a7c50
    restart: unless-stopped
    depends_on:
      karton-redis:
        condition: service_healthy
      minio:
        condition: service_healthy
    environment:
      KARTON_REDIS_HOST: karton-redis
      KARTON_S3_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
      KARTON_S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
      KARTON_S3_ADDRESS: minio:9000
      KARTON_S3_BUCKET: karton
      KARTON_S3_SECURE: "false"
    volumes:
      - ./karton.ini:/etc/karton/karton.ini:ro
    networks:
      - karton

  karton-dashboard:
    image: certpl/karton-dashboard@sha256:af6961a27b4ecbf991ac4d99a7593a58315dbcd115a8e9b0fce139966032ae79
    restart: unless-stopped
    depends_on:
      - karton-system
    environment:
      KARTON_REDIS_HOST: karton-redis
      KARTON_S3_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
      KARTON_S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
      KARTON_S3_ADDRESS: minio:9000
      KARTON_S3_BUCKET: karton
      KARTON_S3_SECURE: "false"
    ports:
      - "8081:5000"
    volumes:
      - ./karton.ini:/etc/karton/karton.ini:ro
    networks:
      - karton

  # ==========================================================================
  # AutoPiff Services
  # ==========================================================================

  # Stage 1-4: Patch Differ (Pairing, Symbols, Matching, Semantic Deltas)
  autopiff-patch-differ:
    build:
      context: .
      dockerfile: services/karton-patch-differ/Dockerfile
    restart: unless-stopped
    depends_on:
      karton-system:
        condition: service_started
      mwdb-core:
        condition: service_healthy
    environment:
      KARTON_REDIS_HOST: karton-redis
      KARTON_S3_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
      KARTON_S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
      KARTON_S3_ADDRESS: minio:9000
      KARTON_S3_BUCKET: karton
      KARTON_S3_SECURE: "false"
      MWDB_API_URL: http://mwdb-core:8080/api/
      MWDB_API_KEY: ${MWDB_API_KEY:-}
      AUTOPIFF_GHIDRA_TIMEOUT: "2400"
    volumes:
      - ./karton.ini:/etc/karton/karton.ini:ro
      - ghidra-cache:/tmp/ghidra_cache
    networks:
      - karton
    healthcheck:
      test: ["CMD", "python3", "-c", "import redis; redis.Redis(host='karton-redis').ping()"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          memory: 8G
        reservations:
          memory: 4G

  # Stage 5: Reachability Tagging
  autopiff-reachability:
    build:
      context: .
      dockerfile: services/karton-reachability/Dockerfile
    restart: unless-stopped
    depends_on:
      karton-system:
        condition: service_started
      mwdb-core:
        condition: service_healthy
    environment:
      KARTON_REDIS_HOST: karton-redis
      KARTON_S3_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
      KARTON_S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
      KARTON_S3_ADDRESS: minio:9000
      KARTON_S3_BUCKET: karton
      KARTON_S3_SECURE: "false"
      MWDB_API_URL: http://mwdb-core:8080/api/
      MWDB_API_KEY: ${MWDB_API_KEY:-}
      AUTOPIFF_GHIDRA_TIMEOUT: "900"
    volumes:
      - ./karton.ini:/etc/karton/karton.ini:ro
      - ghidra-cache:/tmp/ghidra_cache
    networks:
      - karton
    healthcheck:
      test: ["CMD", "python3", "-c", "import redis; redis.Redis(host='karton-redis').ping()"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          memory: 8G
        reservations:
          memory: 4G

  # Stage 6: Scoring & Ranking
  autopiff-ranking:
    build:
      context: .
      dockerfile: services/karton-ranking/Dockerfile
    restart: unless-stopped
    depends_on:
      karton-system:
        condition: service_started
    environment:
      KARTON_REDIS_HOST: karton-redis
      KARTON_S3_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
      KARTON_S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
      KARTON_S3_ADDRESS: minio:9000
      KARTON_S3_BUCKET: karton
      KARTON_S3_SECURE: "false"
    volumes:
      - ./karton.ini:/etc/karton/karton.ini:ro
    networks:
      - karton
    healthcheck:
      test: ["CMD", "python3", "-c", "import redis; redis.Redis(host='karton-redis').ping()"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          memory: 1G

  # Stage 7: Report Generation
  autopiff-report:
    build:
      context: .
      dockerfile: services/karton-report/Dockerfile
    restart: unless-stopped
    depends_on:
      karton-system:
        condition: service_started
      mwdb-core:
        condition: service_healthy
    environment:
      KARTON_REDIS_HOST: karton-redis
      KARTON_S3_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
      KARTON_S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
      KARTON_S3_ADDRESS: minio:9000
      KARTON_S3_BUCKET: karton
      KARTON_S3_SECURE: "false"
      MWDB_API_URL: http://mwdb-core:8080/api/
      MWDB_API_KEY: ${MWDB_API_KEY:-}
    volumes:
      - ./karton.ini:/etc/karton/karton.ini:ro
    networks:
      - karton
    healthcheck:
      test: ["CMD", "python3", "-c", "import redis; redis.Redis(host='karton-redis').ping()"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          memory: 1G

  # DriverAtlas Triage: scores every driver's attack surface
  autopiff-driver-triage:
    build:
      context: .
      dockerfile: services/karton-driver-triage/Dockerfile
      additional_contexts:
        driveratlas-src: ../DriverAtlas
    restart: unless-stopped
    depends_on:
      karton-system:
        condition: service_started
      mwdb-core:
        condition: service_healthy
    environment:
      KARTON_REDIS_HOST: karton-redis
      KARTON_S3_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
      KARTON_S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
      KARTON_S3_ADDRESS: minio:9000
      KARTON_S3_BUCKET: karton
      KARTON_S3_SECURE: "false"
      MWDB_API_URL: http://mwdb-core:8080/api/
      MWDB_API_KEY: ${MWDB_API_KEY:-}
      TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:-}
      TELEGRAM_CHAT_ID: ${TELEGRAM_CHAT_ID:-}
      DRIVERATLAS_SCORE_THRESHOLD: "8.0"
    volumes:
      - ./karton.ini:/etc/karton/karton.ini:ro
    networks:
      - karton
    healthcheck:
      test: ["CMD", "python3", "-c", "import redis; redis.Redis(host='karton-redis').ping()"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          memory: 1G

  # ==========================================================================
  # AutoPiff Dashboard
  # ==========================================================================

  autopiff-dashboard-api:
    build:
      context: .
      dockerfile: services/dashboard/backend/Dockerfile
    restart: unless-stopped
    depends_on:
      mwdb-core:
        condition: service_healthy
    environment:
      MWDB_API_URL: http://mwdb-core:8080/api/
      MWDB_API_KEY: ${MWDB_API_KEY:-}
      AUTOPIFF_ANALYSES_DIR: /data/analyses
      AUTOPIFF_CORPUS_DIR: /data/corpus
      AUTOPIFF_MANIFEST_PATH: /data/corpus_manifest.json
      AUTOPIFF_TRIAGE_PATH: /data/analyses/triage.json
      KARTON_REDIS_HOST: karton-redis
      CORS_ORIGINS: "http://localhost:3000,http://autopiff-dashboard:3000"
    ports:
      - "8000:8000"
    volumes:
      - dashboard-data:/data/analyses
      - ./corpus:/data/corpus:ro
      - ./tests/validation/corpus_manifest.json:/data/corpus_manifest.json:ro
    networks:
      - frontend
      - karton
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  autopiff-dashboard:
    build:
      context: .
      dockerfile: services/dashboard/frontend/Dockerfile
    restart: unless-stopped
    depends_on:
      autopiff-dashboard-api:
        condition: service_healthy
    environment:
      NEXT_PUBLIC_API_URL: http://autopiff-dashboard-api:8000
    ports:
      - "3000:3000"
    networks:
      - frontend

  # ==========================================================================
  # AutoPiff Alert Pipeline
  # ==========================================================================

  # Alerter: Karton consumer that sends Telegram alerts for high-scoring findings
  autopiff-alerter:
    build:
      context: .
      dockerfile: services/autopiff-alerter/Dockerfile
    restart: unless-stopped
    depends_on:
      karton-system:
        condition: service_started
    environment:
      KARTON_REDIS_HOST: karton-redis
      KARTON_S3_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
      KARTON_S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
      KARTON_S3_ADDRESS: minio:9000
      KARTON_S3_BUCKET: karton
      KARTON_S3_SECURE: "false"
      TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:-}
      TELEGRAM_CHAT_ID: ${TELEGRAM_CHAT_ID:-}
      AUTOPIFF_SCORE_THRESHOLD: "8.0"
      AUTOPIFF_DASHBOARD_URL: ${AUTOPIFF_DASHBOARD_URL:-http://localhost:3000}
    volumes:
      - ./karton.ini:/etc/karton/karton.ini:ro
    networks:
      - karton
    healthcheck:
      test: ["CMD", "python3", "-c", "import redis; redis.Redis(host='karton-redis').ping()"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          memory: 512M

  # Driver Monitor: detects new driver versions and uploads to MWDB
  autopiff-driver-monitor:
    build:
      context: .
      dockerfile: services/driver-monitor/Dockerfile
    restart: unless-stopped
    depends_on:
      karton-redis:
        condition: service_healthy
      mwdb-core:
        condition: service_healthy
    environment:
      KARTON_REDIS_HOST: karton-redis
      MWDB_API_URL: http://mwdb-core:8080/api/
      MWDB_API_KEY: ${MWDB_API_KEY:-}
      VT_API_KEY: ${VT_API_KEY:-}
      WINBINDEX_INTERVAL_HOURS: "6"
      VT_INTERVAL_HOURS: "4"
    volumes:
      - ./services/driver-monitor/watchlist.yaml:/app/watchlist.yaml:ro
    networks:
      - karton
    healthcheck:
      test: ["CMD", "python3", "-c", "import redis; redis.Redis(host='karton-redis').ping()"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          memory: 512M

  # ==========================================================================
  # KernelSense: LLM-Augmented Vulnerability Reasoning
  # ==========================================================================

  # Parallel consumer of Stage 6 ranking — enriches findings with LLM analysis
  autopiff-kernelsense:
    build:
      context: .
      dockerfile: services/karton-kernelsense/Dockerfile
    restart: unless-stopped
    depends_on:
      karton-system:
        condition: service_started
    environment:
      KARTON_REDIS_HOST: karton-redis
      KARTON_S3_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
      KARTON_S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
      KARTON_S3_ADDRESS: minio:9000
      KARTON_S3_BUCKET: karton
      KARTON_S3_SECURE: "false"
      OPENAI_API_KEY: ${OPENAI_API_KEY}
      KERNELSENSE_MODEL: gpt-4o
      KERNELSENSE_SCORE_THRESHOLD: "6.0"
      KERNELSENSE_FP_THRESHOLD: "4.0"
      KERNELSENSE_VARIANT_ENABLED: "true"
      KERNELSENSE_VARIANT_CONFIDENCE: "0.70"
      KERNELSENSE_DAILY_TOKEN_BUDGET: ${KERNELSENSE_DAILY_TOKEN_BUDGET:-0}
      KERNELSENSE_EMBEDDINGS_DIR: /data/embeddings
    volumes:
      - ./karton.ini:/etc/karton/karton.ini:ro
      - ghidra-cache:/tmp/ghidra_cache:ro
      - kernelsense-embeddings:/data/embeddings
    networks:
      - karton
    healthcheck:
      test: ["CMD", "python3", "-c", "import redis; redis.Redis(host='karton-redis').ping()"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          memory: 2G
        reservations:
          memory: 1G

  # ==========================================================================
  # Optional: Driver Classifier (routes drivers to AutoPiff)
  # ==========================================================================

  karton-classifier:
    image: certpl/karton-classifier@sha256:3905ca00d7ef2d8067e84b4edaf235a0689df47b1585b9ea850e4bde4285b4c3
    restart: unless-stopped
    depends_on:
      - karton-system
    environment:
      KARTON_REDIS_HOST: karton-redis
      KARTON_S3_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
      KARTON_S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
      KARTON_S3_ADDRESS: minio:9000
      KARTON_S3_BUCKET: karton
      KARTON_S3_SECURE: "false"
    volumes:
      - ./karton.ini:/etc/karton/karton.ini:ro
    networks:
      - karton

networks:
  mwdb-internal:
    # Postgres + Redis only reachable by mwdb-core
    internal: true
  karton:
    # Pipeline backbone: Karton services, MWDB API, MinIO
  frontend:
    # Dashboard frontend <-> API only

volumes:
  mwdb-postgres-data:
  mwdb-uploads:
  minio-data:
  ghidra-cache:
  dashboard-data:
  kernelsense-embeddings: