ZTAP/docker-compose.yml at main · msaadshabir/ZTAP · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
version: "3.8"

services:
  ztap:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: ztap
    hostname: ztap
    privileged: true # Required for eBPF on Linux
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
      - BPF
    volumes:
      - ./examples:/etc/ztap/examples:ro
      - ./config:/etc/ztap/config:ro
      - ztap-data:/var/lib/ztap
      - ztap-logs:/var/log/ztap
      - /sys/fs/cgroup:/sys/fs/cgroup:ro # For eBPF cgroup attachment
    ports:
      - "9090:9090" # Metrics endpoint
    environment:
      - ZTAP_METRICS_LISTEN=0.0.0.0:9090
      # Container-to-container anomaly service address. Host-local development
      # continues to use http://localhost:5000 from the example config.
      - ZTAP_ANOMALY_ENDPOINT=http://anomaly-detector:5000
      - ZTAP_ANOMALY_AUTH_TOKEN=${ZTAP_ANOMALY_TOKEN:-}
    networks:
      - ztap-net
    command: ["metrics", "--port", "9090"]
    restart: unless-stopped
    depends_on:
      - prometheus

  prometheus:
    image: prom/prometheus:v2.48.0
    container_name: ztap-prometheus
    hostname: prometheus
    volumes:
      - ./deployments/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus-data:/prometheus
    ports:
      - "9091:9090" # Expose on different port to avoid conflict
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
      - "--web.console.libraries=/usr/share/prometheus/console_libraries"
      - "--web.console.templates=/usr/share/prometheus/consoles"
      - "--storage.tsdb.retention.time=30d"
    networks:
      - ztap-net
    restart: unless-stopped

  grafana:
    image: grafana/grafana:10.2.2
    container_name: ztap-grafana
    hostname: grafana
    volumes:
      - ./deployments/grafana/dashboards:/etc/grafana/provisioning/dashboards:ro
      - ./deployments/grafana/datasources:/etc/grafana/provisioning/datasources:ro
      - grafana-data:/var/lib/grafana
    environment:
      - GF_SECURITY_ADMIN_USER=admin
      - GF_SECURITY_ADMIN_PASSWORD=ztap
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_SERVER_ROOT_URL=http://localhost:3000
    ports:
      - "3000:3000"
    networks:
      - ztap-net
    restart: unless-stopped
    depends_on:
      - prometheus

  # Anomaly detection microservice
  anomaly-detector:
    build:
      context: ./internal/anomaly
      dockerfile: Dockerfile
    container_name: ztap-anomaly
    hostname: anomaly-detector
    volumes:
      - anomaly-data:/app/data
      - anomaly-models:/app/models
    ports:
      - "5000:5000"
    environment:
      # Gunicorn binds 0.0.0.0 so the agent can reach the service from
      # another container on ztap-net (see the Dockerfile ENV).
      - ZTAP_ANOMALY_HOST=0.0.0.0
      - MODEL_PATH=/app/models
      - ZTAP_ANOMALY_TOKEN=${ZTAP_ANOMALY_TOKEN:-}
    networks:
      - ztap-net
    restart: unless-stopped
    healthcheck:
      # python:3.14-slim has no curl; probe /health with urllib instead.
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:5000/health')"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

networks:
  ztap-net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16

volumes:
  ztap-data:
    driver: local
  ztap-logs:
    driver: local
  prometheus-data:
    driver: local
  grafana-data:
    driver: local
  anomaly-data:
    driver: local
  anomaly-models:
    driver: local