opencti icon indicating copy to clipboard operation
opencti copied to clipboard

Suggestion for Improvement of Deployment: Separate API and Frontend containers

Open iFrozenPhoenix opened this issue 10 months ago • 2 comments

Use case

By the docs and by experience the ingestion endpoint and the frontend endpoint should be separate containers / services. Currently the way to go is to deploy the platform container once for the frontend and once for ingestion. It would make the deployment more undestandable, easier to configure and reduce size and potential risks if there would be a separate container image that could be used for ingestion that only contains the graphql api, without the actual frontend.

Current Workaround

Build the images myself (But not done)

Proposed Solution

Build an additional container image with only the api.

Additional Information

Currently I don't know if the frontend is ssr or if it only uses the api. If it only uses the api it would make even more sense to build 2 images, 1 with the api and 1 with a webserver and the frontend.

If the feature request is approved, would you be willing to submit a PR?

Yes, but would probably need help.

iFrozenPhoenix avatar Apr 05 '24 15:04 iFrozenPhoenix

Honestly i'm not sure about this. Currently the size overhead is 27Mo always providing the front in the platform image. For me generating 2 images will be more confusing for people and will save you a really low amount of Mb. However i can understand that you want to prevent your ingestion node to provide the UI for security issue, and i think we can add an option in the platform to protect this like APP__UI_ENABLED=true/false

richard-julien avatar Apr 29 '24 08:04 richard-julien

This sounds like a reasonable approach.

iFrozenPhoenix avatar Apr 29 '24 08:04 iFrozenPhoenix