[WIP]: Harden images and reorg

[bstrdsmkr]

Description

• Harden frontend image
  • rebase on https://github.com/nginxinc/docker-nginx-unprivileged
  • removes privileged port usage in base image
  • moves writeable directories out of user control
  • Updates throughout to use relative links only so that images can be build once and used in any deployment
  • All configuration is now retrieved from the backend at runtime so that the image is fully static and immutable
• Harden backend image
  • move writable directories out of user control
  • run collectstatic during image build
  • generate SBOM for backend at well-known location
• Upgrade postgres to address vulnerabilities
• Unify configuration to single .env file
• Set sane defaults for config so that docker compose:
  • runs with podman compose
  • stands up fully functional stack out of the box
• Configure gunicorn for backend automatically based on resources available
• Fix broken links and warnings in docs

Type of change

• Bug fix (non-breaking change which fixes an issue)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

• [x] Local Tests
• [ ] CI/CD Build

Checklist

• [x] My code follows the style guidelines of this project
• [x] I have performed a self-review of my own code
• [x] My changes generate no new warnings
• [x] If applicable - I have commented my code, particularly in hard-to-understand areas
• [ ] If applicable - I have made corresponding changes to the documentation
• [x] If applicable - I have added tests that prove my fix is effective or that my feature works
• [x] If applicable - New and existing unit tests pass locally with my changes
• [x] Any dependent changes have been merged and published in downstream modules

[sashakames]

Hey, could the Docker Compose .yaml files be restored, please? We still use that as a single node alternative to K8S/Helm? Thanks!

[bstrdsmkr]

@sashakames first I just want to say that I know this is rough and needs a lot of work so you're not going to hurt my feelings, please give it a thorough scrub :grin:

re: Docker compose -- my drive there was to consolidate the various pieces into a single Docker compose file that new users could stand up out-of-the-box and not need to configure anything. Then an overlay compose file could be used to override things that needed to be changed for production (in conjunction with the existing env vars). So, there should now be only two Docker compose related files in the root of the repo. (Fair warning that I can't fully test the Production setup so I'm hoping you can :grin: )

Does that address your concern?

[sashakames]

@bstrdsmkr You'll need to merge/rebase with the update to master done today, then we are making this priority #1