defectdojo-django — DefectDojo Django + Celery image rebased on Red Hat Hardened Images
954
DefectDojo is the application security finding-management platform that anchors this project's CI scanning pipeline. Pipelines push scan results into DefectDojo via re-import; humans triage, accept risk, or close findings from the same UI.
This image rebases DefectDojo v2.58.2 onto hi/python:3.13-builder.
Deployments invoke this image as four distinct services, with role differentiation happening at
the Quadlet level via Exec= (the entrypoint override). All four pull the same digest:
| Role | Quadlet unit | Entrypoint | Purpose |
|---|---|---|---|
| django (web) | defectdojo-django.container | /entrypoint-uwsgi.sh | uWSGI serving the Django app on port 3031 |
| celery-worker | defectdojo-celery-worker.container | /entrypoint-celery-worker.sh | Async task runner (re-import processing, scheduled jobs) |
| celery-beat | defectdojo-celery-beat.container | /entrypoint-celery-beat.sh | Scheduled task dispatcher |
| initializer | defectdojo-initializer.container | /entrypoint-initializer.sh | Oneshot: DB migrations, admin bootstrap, initial-data seed; exits when done |
This is intentional. A single image keeps the app code, Python deps, and overlay patches identical
across every service — no chance for celery and django to drift, no parallel build pipelines to keep
in sync, no duplicate registry storage (Harbor and Docker Hub deduplicate same-digest pushes).
Operators see seven containers in the Quadlet stack (defectdojo-{postgres,valkey,initializer,django,celery-worker,celery-beat,nginx})
but only four distinct images to mirror, sign, attest, and audit.
The build applies one upstream overlay patch: psycopg[c]==3.3.3 → psycopg[binary]==3.3.3. Hummingbird
OS doesn't ship a redistributable libpq-devel package; psycopg's [binary] extra is upstream's
official manylinux wheel that bundles libpq.
Consumed by the DefectDojo Quadlet stack (see defectdojo/quadlet/). Direct invocation is unusual;
each of the four roles in the table above lives in its own Quadlet unit with the same Image= line.
registry.access.redhat.com/hi/python:3.13-builder for build and runtime
(see Containerfile commentary for the rationale — DefectDojo's C-extension deps need
several .so files the distroless hi/python:3.13 runtime doesn't ship).6eab87386d504c4bc164f87b6aae58a8e0c1b8d2 (tag v2.58.2)pip-compile --generate-hashes against the post-overlay
requirements.txt.defectdojo/upstream-overlay/requirements.txt.patchContent type
Image
Digest
sha256:5967256c5…
Size
239.1 MB
Last updated
4 months ago
docker pull timothyswan/defectdojo-django:2.58.3-rhhi