daljeetbarmi/resource-json-sanitiser repository overview

⁠Resource JSON Sanitiser

Sanitises Azure / AWS resource export JSON by replacing sensitive values — resource identifiers, subscription/account IDs, IP addresses, container images, org URLs — with numbered placeholders like REDACTED_IP_1. Also supports custom text patterns (organisation names, people's names, project codenames) supplied at runtime.

⁠What gets redacted automatically

Plus any custom literal text or regex patterns you supply (e.g. your organisation's name, a person's name).

⁠Running in Docker

docker compose up --build

Open http://localhost:5001⁠

Or without compose:

docker build -t resource-json-sanitiser:local .
docker run -p 5001:5001 -e FLASK_SECRET_KEY=$(openssl rand -hex 32) resource-json-sanitiser:local

⁠Running from Docker Hub

Published image:

daljeetbarmi/resource-json-sanitiser:latest

Pull and run:

docker pull daljeetbarmi/resource-json-sanitiser:latest
docker run -p 5001:5001 -e FLASK_SECRET_KEY=$(openssl rand -hex 32) daljeetbarmi/resource-json-sanitiser:latest

Open http://localhost:5001⁠

⁠Notes on design

• The sanitiser is implemented as a Sanitiser class rather than module-level globals, so each upload/CLI run gets its own isolated counters — safe for concurrent requests under Flask.
• Uploaded files and sanitised output are kept in memory only; nothing is written to disk by the web app. Sanitised results are held briefly in an in-memory dict, keyed by a one-time download token, and removed immediately after download.
• Flask binds to 0.0.0.0:5001 so it's reachable from outside the container.
• FLASK_SECRET_KEY should be set to a real secret in any non-local deployment (used only for flash-message session signing).
• The in-memory result store means restarting the container, or running multiple replicas behind a load balancer, will lose pending downloads. Fine for a single-instance internal tool; for anything more, swap in Redis or similar.