opencti
opencti copied to clipboard
Suggestion for Improvement of Deployment: Separate API and Frontend containers
Use case
By the docs and by experience the ingestion endpoint and the frontend endpoint should be separate containers / services. Currently the way to go is to deploy the platform container once for the frontend and once for ingestion. It would make the deployment more undestandable, easier to configure and reduce size and potential risks if there would be a separate container image that could be used for ingestion that only contains the graphql api, without the actual frontend.
Current Workaround
Build the images myself (But not done)
Proposed Solution
Build an additional container image with only the api.
Additional Information
Currently I don't know if the frontend is ssr or if it only uses the api. If it only uses the api it would make even more sense to build 2 images, 1 with the api and 1 with a webserver and the frontend.
If the feature request is approved, would you be willing to submit a PR?
Yes, but would probably need help.
Honestly i'm not sure about this. Currently the size overhead is 27Mo always providing the front in the platform image. For me generating 2 images will be more confusing for people and will save you a really low amount of Mb. However i can understand that you want to prevent your ingestion node to provide the UI for security issue, and i think we can add an option in the platform to protect this like APP__UI_ENABLED=true/false
This sounds like a reasonable approach.