LocalStack Build And Push Docker Images and Other Improvements

.gitignore

@@ -11,6 +11,7 @@ __pycache__
 !.env.e2e
 !.env.e2e-tests
 !.env.fuzz-tests
+!.env.localstack
 !.env.unit-tests
 .github/instructions/snyk_rules.instructions.md
 .idea

docker-compose/infrastructure/compose.yaml

@@ -16,6 +16,7 @@ services:
     networks:
       - infrastructure-nest
     ports:
+      - 443:443
       - 4510-4559:4510-4559
       - 4566:4566
     volumes:
@@ -29,11 +30,22 @@ services:
     environment:
       LOCALSTACK_AUTH_TOKEN: ${LOCALSTACK_AUTH_TOKEN}
       LOCALSTACK_HOST: localhost
+    group_add:
+      # Grant access to the mounted docker socket. Its in-container GID varies:
+      # Linux exposes the host docker group's GID; macOS runtimes (Docker Desktop,
+      # OrbStack, colima, etc) proxy the socket through a Linux VM and it typically
+      # shows up as root:root inside the container.
+      - '0'
+      - ${DOCKER_GID}
     image: nest-infrastructure
     network_mode: service:localstack
     pull_policy: never
     volumes:
       - infrastructure-terraform-plugin-cache:/home/owasp/.terraform.d/plugin-cache
+      # Host Docker socket so runner can build containers (Backend, Frontend, etc.).
+      - /var/run/docker.sock:/var/run/docker.sock
+      # Host repo as docker build context for backend/frontend images.
+      - ../..:/repo:ro
 
 networks:
   infrastructure-nest:

docker/infrastructure/Dockerfile

@@ -44,6 +44,8 @@
 ARG OWASP_GID
 ARG OWASP_UID
 
+RUN apk --no-cache add docker-cli docker-cli-buildx
+
 RUN addgroup -S -g ${OWASP_GID} owasp && \
     adduser -S -h /home/owasp -u ${OWASP_UID} -G owasp owasp && \
     mkdir -p \
@@ -70,6 +72,10 @@
 COPY --from=terraform --chmod=555 --chown=root:root /bin/terraform /usr/local/bin/terraform
 COPY --from=builder --chown=owasp:owasp /home/owasp /home/owasp
 
+# Infrastructure sources are copied (not mounted) so tflocal can write .terraform/
+# and LocalStack override files inside the container without polluting the host.
+# A read-only mount would fail those writes and a read-write mount would leak them
+# to the host. Copying keeps writes scoped to the container lifetime.
 COPY --chown=owasp:owasp infrastructure/bootstrap /home/owasp/infrastructure/bootstrap
 COPY --chown=owasp:owasp infrastructure/live      /home/owasp/infrastructure/live
 COPY --chown=owasp:owasp infrastructure/modules   /home/owasp/infrastructure/modules

docker/localstack/Dockerfile

@@ -1 +1 @@
-FROM localstack/localstack:2026.7.1@sha256:bdc261f58767dda5385800cfcefae7e8036f91428f26117b29c4572a7a9bbdc9
+FROM localstack/localstack:2026.7.4@sha256:f7b778d03717b58c3adce81a740bfafff5c6f9d639159bbf08da557c9ac1b513

frontend/.env.localstack

@@ -0,0 +1,11 @@
+NEXT_PUBLIC_API_URL=/
+NEXT_PUBLIC_CSRF_URL=/csrf/
+NEXT_PUBLIC_ENVIRONMENT=production
+NEXT_PUBLIC_GRAPHQL_URL=/graphql/
+NEXT_PUBLIC_GTM_ID=
+NEXT_PUBLIC_IDX_URL=/idx/
+NEXT_PUBLIC_IS_PROJECT_HEALTH_ENABLED=true
+NEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com
+NEXT_PUBLIC_POSTHOG_KEY=
+NEXT_PUBLIC_RELEASE_VERSION=
+NEXT_PUBLIC_SENTRY_DSN=

infrastructure/live/terraform.localstack.tfbackend.example

@@ -1,3 +1,5 @@
 bucket         = "nest-localstack-terraform-state"
+endpoints      = { s3 = "http://localstack:4566" }
 key            = "localstack/terraform.tfstate"
 region         = "us-east-1"
+use_path_style = true

infrastructure/make/run.mk

@@ -1,20 +1,28 @@
-.PHONY: infrastructure-up
+.PHONY: infrastructure-check-auth-token infrastructure-refresh infrastructure-up
+
+DOCKER_GID := $(shell stat -c '%g' /var/run/docker.sock 2>/dev/null || stat -f '%g' /var/run/docker.sock)
+export DOCKER_GID
 
 INFRASTRUCTURE_COMPOSE = docker compose \
 	--project-name nest-infrastructure \
 	-f docker-compose/infrastructure/compose.yaml
 
-infrastructure-up: ## Start LocalStack and deploy infrastructure
+infrastructure-check-auth-token:
 	@if [ -z "$$LOCALSTACK_AUTH_TOKEN" ]; then \
 		if [ -t 2 ]; then \
 			printf '\033[1;31mError:\033[0m LOCALSTACK_AUTH_TOKEN is not set.\n' >&2; \
 		else \
 			echo "Error: LOCALSTACK_AUTH_TOKEN is not set." >&2; \
 		fi; \
 		exit 1; \
-	fi; \
-	$(MAKE) infrastructure-image-build || exit $$?; \
-	COMPOSE_BAKE=true DOCKER_BUILDKIT=1 \
-		$(INFRASTRUCTURE_COMPOSE) \
-			-f docker-compose/infrastructure/compose.deploy.yaml \
-			up
+	fi
+
+infrastructure-refresh: infrastructure-check-auth-token ## Refresh an existing deployment on LocalStack
+	@$(MAKE) infrastructure-image-build || exit $$?; \
+	$(INFRASTRUCTURE_COMPOSE) up --wait localstack || exit $$?; \
+	$(INFRASTRUCTURE_COMPOSE) run --rm runner python -m scripts.run_deploy --refresh
+
+infrastructure-up: infrastructure-check-auth-token ## Start LocalStack and deploy infrastructure
+	@$(MAKE) infrastructure-image-build || exit $$?; \
+	$(INFRASTRUCTURE_COMPOSE) up --wait localstack || exit $$?; \
+	$(INFRASTRUCTURE_COMPOSE) run --rm runner python -m scripts.run_deploy

infrastructure/make/test.mk

@@ -44,12 +44,6 @@ infrastructure-test-integration:
 	$(MAKE) infrastructure-image-build || exit $$?; \
 	status=0; \
 	trap '$(INFRASTRUCTURE_COMPOSE) down --remove-orphans >/dev/null 2>&1 || true' EXIT; \
-	COMPOSE_BAKE=true DOCKER_BUILDKIT=1 \
-		$(INFRASTRUCTURE_COMPOSE) \
-			-f docker-compose/infrastructure/compose.integration.yaml \
-			up \
-			--abort-on-container-exit \
-			--build \
-			--exit-code-from runner \
-		|| status=$$?; \
+	$(INFRASTRUCTURE_COMPOSE) up --wait localstack || exit $$?; \
+	$(INFRASTRUCTURE_COMPOSE) run --rm runner python -m scripts.run_tests --integration || status=$$?; \
 	exit $$status