142 lines
4.7 KiB
Docker
142 lines
4.7 KiB
Docker
# ───────────────────────────────────────────────────────────
|
|
# Ansible Control Node — Docker Image
|
|
#
|
|
# Purpose: Runs IEC 62443-3-3 compliance tests against
|
|
# Windows, Cisco, VMware, MSSQL, and Linux targets.
|
|
#
|
|
# Deployment targets:
|
|
# • Kubernetes / Docker Swarm (native)
|
|
# • Alpine Docker Host on QEMU (docker run on Windows VMs)
|
|
# • Any Linux with Docker
|
|
#
|
|
# Integrations:
|
|
# • Windows — pywinrm + kerberos → WinRM
|
|
# • Cisco ASA — cisco.asa + paramiko → SSH/CLI
|
|
# • Cisco Catalyst— cisco.ios + netmiko → SSH/CLI
|
|
# • Cisco NX-OS — cisco.nxos + ncclient → SSH/NX-API
|
|
# • VMware — pyvmomi → vCenter/ESXi SOAP API
|
|
# • MSSQL — pymssql → SQL Server TDS
|
|
# • Linux — native SSH (built-in ansible)
|
|
#
|
|
# Usage:
|
|
# docker build -t ansible-node -f Dockerfile.ansible .
|
|
# docker run --rm -v $(pwd)/playbooks:/ansible/playbooks \
|
|
# -v $(pwd)/inventory.ini:/ansible/inventory.ini \
|
|
# ansible-node site.yml
|
|
# ───────────────────────────────────────────────────────────
|
|
|
|
FROM alpine:3.20
|
|
|
|
LABEL org.opencontainers.image.title="Ansible Control Node"
|
|
LABEL org.opencontainers.image.description="Ansible with collections for Windows, Cisco, VMware, MSSQL, and Linux targets"
|
|
|
|
# ── Runtime + build dependencies ───────────────────────────
|
|
RUN apk add --no-cache \
|
|
ansible \
|
|
sshpass \
|
|
openssh-client \
|
|
py3-pip \
|
|
python3 \
|
|
python3-dev \
|
|
gcc \
|
|
musl-dev \
|
|
openssl-dev \
|
|
krb5 \
|
|
krb5-dev \
|
|
libffi-dev \
|
|
freetds \
|
|
freetds-dev \
|
|
bash \
|
|
curl \
|
|
ca-certificates \
|
|
git
|
|
|
|
# ── Python packages for target integrations ──────────────
|
|
RUN pip3 install --no-cache-dir --break-system-packages \
|
|
'pywinrm[kerberos]>=0.4' \
|
|
requests-kerberos \
|
|
requests-ntlm \
|
|
paramiko>=2.7 \
|
|
ncclient>=0.6 \
|
|
netmiko>=4.0 \
|
|
scp \
|
|
pyvmomi>=8.0 \
|
|
requests \
|
|
pymssql>=2.2 \
|
|
jmespath>=1.0 \
|
|
xmltodict>=0.13 \
|
|
pyyaml>=6.0 \
|
|
cryptography>=41.0 \
|
|
packaging \
|
|
fpdf2>=2.7
|
|
|
|
# ── Ansible collections ──────────────────────────────────
|
|
RUN ansible-galaxy collection install \
|
|
ansible.windows \
|
|
ansible.netcommon \
|
|
ansible.utils \
|
|
cisco.asa \
|
|
cisco.ios \
|
|
cisco.nxos \
|
|
community.vmware \
|
|
community.general \
|
|
community.crypto \
|
|
microsoft.sql
|
|
|
|
# ── Purge build-only dependencies ─────────────────────────
|
|
# apk del cascades to shared deps like util-linux (mount/umount).
|
|
# Re-add it with network access (not --no-network here).
|
|
RUN apk del --no-network \
|
|
gcc \
|
|
musl-dev \
|
|
python3-dev \
|
|
openssl-dev \
|
|
krb5-dev \
|
|
libffi-dev \
|
|
freetds-dev \
|
|
&& apk add --no-cache util-linux
|
|
|
|
# ── Ansible config ────────────────────────────────────────
|
|
RUN mkdir -p /etc/ansible && \
|
|
printf '[defaults]\n\
|
|
host_key_checking = False\n\
|
|
stdout_callback = yaml\n\
|
|
callback_whitelist = profile_tasks\n\
|
|
retry_files_enabled = False\n\
|
|
inventory = /ansible/inventory/inventory.ini\n\
|
|
\n\
|
|
[ssh_connection]\n\
|
|
pipelining = True\n\
|
|
control_path = /tmp/ansible-%%h-%%p-%%r' \
|
|
> /etc/ansible/ansible.cfg
|
|
|
|
# ── Working directory ─────────────────────────────────────
|
|
RUN mkdir -p /ansible/playbooks /ansible/inventory
|
|
WORKDIR /ansible
|
|
|
|
# ── Container web UI (JSON / Markdown / PDF export) ──────
|
|
COPY webui/container-app.py /usr/local/bin/container-webui.py
|
|
COPY reports/render_report.py /ansible/reports/render_report.py
|
|
RUN chmod +x /usr/local/bin/container-webui.py
|
|
|
|
# ── Default inventory (placeholder) ───────────────────────
|
|
RUN printf '[windows]\n\
|
|
[cisco_asa]\n\
|
|
[cisco_ios]\n\
|
|
[cisco_nxos]\n\
|
|
[vmware]\n\
|
|
[mssql]\n\
|
|
[linux]\n\
|
|
\n\
|
|
[all:vars]\n\
|
|
ansible_user=ansible\n' \
|
|
> /ansible/inventory/inventory.ini
|
|
|
|
# ── Entrypoint: web UI by default, ansible-playbook if args ─
|
|
# docker run -p 8080:8080 ansible-node → web UI
|
|
# docker run ansible-node site.yml -i hosts → ansible-playbook
|
|
COPY scripts/entrypoint.sh /usr/local/bin/entrypoint.sh
|
|
RUN chmod +x /usr/local/bin/entrypoint.sh
|
|
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
|
|
CMD []
|