# docker-compose.security-platform.yml
version: '3.8'

services:
  # Security Orchestrator
  security-orchestrator:
    build: ./security-orchestrator
    networks:
      - security-mgmt
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - security-policies:/etc/security/policies:ro
      - security-logs:/var/log/security
    environment:
      - SECURITY_LEVEL=enterprise
      - COMPLIANCE_STANDARDS=SOC2,PCI_DSS,HIPAA,GDPR
      - AUTO_REMEDIATION=true
      - ALERT_WEBHOOK=${SECURITY_WEBHOOK_URL}
    secrets:
      - security_encryption_key
      - siem_api_key

  # Vulnerability Scanner
  vulnerability-scanner:
    image: aquasec/trivy:latest
    networks:
      - security-mgmt
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - trivy-cache:/root/.cache/trivy
      - scan-results:/results
    environment:
      - TRIVY_DB_REPOSITORY=ghcr.io/aquasecurity/trivy-db
      - TRIVY_JAVA_DB_REPOSITORY=ghcr.io/aquasecurity/trivy-java-db
    command: |
      sh -c "
        while true; do
          echo 'Starting vulnerability scan...'
          for image in $(docker images --format '{{.Repository}}:{{.Tag}}' | grep -v '<none>'); do
            echo 'Scanning $image'
            trivy image --format json --output /results/scan_$(echo $image | tr '/:' '_')_$(date +%Y%m%d_%H%M%S).json $image
          done
          sleep 3600  # Scan every hour
        done
      "

  # Runtime Security Monitor (Falco)
  falco:
    image: falcosecurity/falco:latest
    privileged: true
    networks:
      - security-mgmt
    volumes:
      - /var/run/docker.sock:/host/var/run/docker.sock
      - /dev:/host/dev
      - /proc:/host/proc:ro
      - /boot:/host/boot:ro
      - /lib/modules:/host/lib/modules:ro
      - /usr:/host/usr:ro
      - ./falco/falco.yaml:/etc/falco/falco.yaml:ro
      - ./falco/rules:/etc/falco/rules:ro
    environment:
      - FALCO_GRPC_ENABLED=true
      - FALCO_GRPC_BIND_ADDRESS=0.0.0.0:5060
      - FALCO_WEBSERVER_ENABLED=true

  # Security Information and Event Management
  siem-collector:
    build: ./siem-collector
    networks:
      - security-mgmt
    volumes:
      - security-logs:/var/log/security:ro
      - siem-data:/var/lib/siem
    environment:
      - ELASTICSEARCH_URL=http://elasticsearch:9200
      - KIBANA_URL=http://kibana:5601
      - LOG_SOURCES=falco,trivy,docker,system
    depends_on:
      - elasticsearch
      - kibana

  # Elasticsearch for log storage
  elasticsearch:
    image: elasticsearch:7.17.0
    networks:
      - security-mgmt
    volumes:
      - elasticsearch-data:/usr/share/elasticsearch/data
    environment:
      - discovery.type=single-node
      - "ES_JAVA_OPTS=-Xms2g -Xmx2g"
      - xpack.security.enabled=true
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}

  # Kibana for security dashboards
  kibana:
    image: kibana:7.17.0
    networks:
      - security-mgmt
    ports:
      - "5601:5601"
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - ELASTICSEARCH_USERNAME=elastic
      - ELASTICSEARCH_PASSWORD=${ELASTIC_PASSWORD}
    volumes:
      - ./kibana/dashboards:/usr/share/kibana/data/dashboards:ro
    depends_on:
      - elasticsearch

  # Compliance Reporter
  compliance-reporter:
    build: ./compliance-reporter
    networks:
      - security-mgmt
    volumes:
      - compliance-reports:/reports
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - REPORT_SCHEDULE=0 6 * * *  # Daily at 6 AM
      - COMPLIANCE_FRAMEWORKS=CIS_DOCKER,NIST_CSF,ISO27001
      - REPORT_FORMAT=pdf,json,html
      - NOTIFICATION_EMAIL=${COMPLIANCE_EMAIL}

  # Certificate Management
  cert-manager:
    image: jetstack/cert-manager-controller:latest
    networks:
      - security-mgmt
    volumes:
      - cert-data:/var/lib/cert-manager
      - ./cert-manager/config.yaml:/etc/cert-manager/config.yaml:ro
    environment:
      - ACME_EMAIL=${ACME_EMAIL}
      - DNS_PROVIDER=${DNS_PROVIDER}

  # Secrets Management (Vault)
  vault:
    image: vault:latest
    networks:
      - security-mgmt
    ports:
      - "8200:8200"
    volumes:
      - vault-data:/vault/data
      - vault-logs:/vault/logs
      - ./vault/config.hcl:/vault/config/config.hcl:ro
    environment:
      - VAULT_CONFIG_DIR=/vault/config
      - VAULT_LOG_LEVEL=info
    cap_add:
      - IPC_LOCK
    command: vault server -config=/vault/config/config.hcl

networks:
  security-mgmt:
    driver: bridge
    driver_opts:
      com.docker.network.bridge.enable_icc: "true"
      encrypted: "true"

volumes:
  security-policies:
  security-logs:
  trivy-cache:
  scan-results:
  siem-data:
  elasticsearch-data:
  compliance-reports:
  cert-data:
  vault-data:
  vault-logs:

secrets:
  security_encryption_key:
    external: true
  siem_api_key:
    external: true

# docker-compose.performance-platform.yml
version: '3.8'

services:
  # Performance Orchestrator
  performance-orchestrator:
    build: ./performance-orchestrator
    privileged: true
    networks:
      - performance-mgmt
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - performance-data:/data
    environment:
      - OPTIMIZATION_MODE=aggressive
      - AUTO_SCALING=true
      - PERFORMANCE_TARGETS=cpu:80,memory:85,latency:100ms
      - MONITORING_INTERVAL=10s

  # Application Performance Monitoring
  apm-server:
    image: elastic/apm-server:7.17.0
    networks:
      - performance-mgmt
    volumes:
      - ./apm/apm-server.yml:/usr/share/apm-server/apm-server.yml:ro
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    depends_on:
      - elasticsearch

  # Distributed Tracing (Jaeger)
  jaeger:
    image: jaegertracing/all-in-one:latest
    networks:
      - performance-mgmt
    ports:
      - "16686:16686"
      - "14268:14268"
    environment:
      - COLLECTOR_ZIPKIN_HTTP_PORT=9411
      - SPAN_STORAGE_TYPE=elasticsearch
      - ES_SERVER_URLS=http://elasticsearch:9200
    depends_on:
      - elasticsearch

  # Metrics Collection (Prometheus)
  prometheus:
    image: prom/prometheus:latest
    networks:
      - performance-mgmt
    ports:
      - "9090:9090"
    volumes:
      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./prometheus/rules:/etc/prometheus/rules:ro
      - prometheus-data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.retention.time=30d'
      - '--web.enable-lifecycle'
      - '--storage.tsdb.path=/prometheus'

  # Performance Visualization (Grafana)
  grafana:
    image: grafana/grafana:latest
    networks:
      - performance-mgmt
    ports:
      - "3000:3000"
    volumes:
      - grafana-data:/var/lib/grafana
      - ./grafana/provisioning:/etc/grafana/provisioning:ro
      - ./grafana/dashboards:/var/lib/grafana/dashboards:ro
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD}
      - GF_INSTALL_PLUGINS=grafana-piechart-panel,grafana-worldmap-panel,grafana-clock-panel

  # Load Testing Platform
  load-tester:
    build: ./load-tester
    networks:
      - performance-mgmt
    volumes:
      - load-test-results:/results
      - ./load-tests:/tests:ro
    environment:
      - TEST_SCHEDULE=0 2 * * *  # Daily at 2 AM
      - TARGET_APPLICATIONS=${TARGET_APPS}
      - PERFORMANCE_THRESHOLDS=response_time:500ms,throughput:1000rps,error_rate:1%

  # Performance Profiler
  profiler:
    build: ./profiler
    privileged: true
    networks:
      - performance-mgmt
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - profiler-data:/data
      - /sys/kernel/debug:/sys/kernel/debug:ro
    environment:
      - PROFILING_MODE=continuous
      - PROFILE_TARGETS=cpu,memory,io,network
      - FLAME_GRAPH_ENABLED=true

  # Auto-Scaler
  auto-scaler:
    build: ./auto-scaler
    networks:
      - performance-mgmt
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - SCALING_POLICIES=cpu:80:scale_up,cpu:30:scale_down,memory:85:scale_up
      - MIN_REPLICAS=2
      - MAX_REPLICAS=20
      - COOLDOWN_PERIOD=300s

networks:
  performance-mgmt:
    driver: bridge

volumes:
  performance-data:
  prometheus-data:
  grafana-data:
  load-test-results:
  profiler-data:

#!/usr/bin/env python3
# intelligent-ops-platform.py

import asyncio
import docker
import json
import logging
import numpy as np
from datetime import datetime, timedelta
from typing import Dict, List, Optional, Tuple
import aioredis
import aiohttp
from dataclasses import dataclass
import yaml

@dataclass
class SecurityAlert:
    id: str
    severity: str
    type: str
    container_id: str
    description: str
    timestamp: datetime
    metadata: Dict

@dataclass
class PerformanceMetric:
    container_id: str
    metric_type: str
    value: float
    timestamp: datetime
    threshold: Optional[float] = None

class IntelligentOpsManager:
    def __init__(self, config_path: str):
        with open(config_path, 'r') as f:
            self.config = yaml.safe_load(f)
        
        self.docker_client = docker.from_env()
        self.redis = None
        self.session = None
        
        # ML models for prediction (simplified)
        self.performance_model = None
        self.security_model = None
        
        # Operational state
        self.active_alerts = {}
        self.performance_history = {}
        self.security_incidents = {}
        
    async def initialize(self):
        """Initialize async components"""
        self.redis = await aioredis.from_url("redis://localhost:6379")
        self.session = aiohttp.ClientSession()
        
        # Load ML models
        await self.load_ml_models()
        
    async def load_ml_models(self):
        """Load machine learning models for predictions"""
        # In production, load actual trained models
        # For demo, using simple statistical models
        self.performance_model = {
            'cpu_threshold': 80.0,
            'memory_threshold': 85.0,
            'prediction_window': 300  # 5 minutes
        }
        
        self.security_model = {
            'anomaly_threshold': 2.0,  # Standard deviations
            'risk_factors': {
                'privileged_containers': 0.8,
                'root_processes': 0.6,
                'network_anomalies': 0.7
            }
        }
    
    async def continuous_monitoring(self):
        """Main monitoring loop"""
        while True:
            try:
                # Collect metrics
                await self.collect_security_metrics()
                await self.collect_performance_metrics()
                
                # Analyze and predict
                await self.analyze_security_posture()
                await self.analyze_performance_trends()
                
                # Take automated actions
                await self.execute_automated_responses()
                
                # Update dashboards
                await self.update_operational_dashboards()
                
                await asyncio.sleep(30)  # Monitor every 30 seconds
                
            except Exception as e:
                logging.error(f"Monitoring error: {e}")
                await asyncio.sleep(60)
    
    async def collect_security_metrics(self):
        """Collect comprehensive security metrics"""
        containers = self.docker_client.containers.list()
        
        for container in containers:
            try:
                # Check container configuration
                config_score = await self.assess_container_security(container)
                
                # Check runtime behavior
                runtime_score = await self.assess_runtime_security(container)
                
                # Calculate overall security score
                security_score = (config_score + runtime_score) / 2
                
                # Store metrics
                await self.redis.hset(
                    f"security:{container.id}",
                    mapping={
                        'config_score': config_score,
                        'runtime_score': runtime_score,
                        'overall_score': security_score,
                        'timestamp': datetime.now().isoformat()
                    }
                )
                
                # Generate alerts if needed
                if security_score < self.config['security']['alert_threshold']:
                    await self.create_security_alert(container, security_score)
                    
            except Exception as e:
                logging.error(f"Error collecting security metrics for {container.name}: {e}")
    
    async def assess_container_security(self, container) -> float:
        """Assess container security configuration"""
        score = 100.0
        
        # Check if running as root
        config = container.attrs['Config']
        if not config.get('User'):
            score -= 20
        
        # Check privileged mode
        host_config = container.attrs['HostConfig']
        if host_config.get('Privileged'):
            score -= 30
        
        # Check capabilities
        cap_add = host_config.get('CapAdd', [])
        dangerous_caps = ['SYS_ADMIN', 'NET_ADMIN', 'SYS_PTRACE']
        for cap in cap_add:
            if cap in dangerous_caps:
                score -= 15
        
        # Check read-only filesystem
        if not host_config.get('ReadonlyRootfs'):
            score -= 10
        
        # Check security options
        security_opt = host_config.get('SecurityOpt', [])
        if 'no-new-privileges:true' not in security_opt:
            score -= 10
        
        return max(0, score)
    
    async def assess_runtime_security(self, container) -> float:
        """Assess container runtime security"""
        score = 100.0
        
        try:
            # Check running processes
            result = container.exec_run("ps aux", demux=True)
            if result.exit_code == 0:
                processes = result.output[0].decode()
                
                # Check for suspicious processes
                suspicious_procs = ['nc', 'netcat', 'nmap', 'wget', 'curl']
                for proc in suspicious_procs:
                    if proc in processes.lower():
                        score -= 15
                
                # Check for root processes
                if 'root' in processes:
                    score -= 10
            
            # Check network connections
            result = container.exec_run("netstat -tuln", demux=True)
            if result.exit_code == 0:
                connections = result.output[0].decode()
                
                # Check for suspicious ports
                suspicious_ports = ['22', '23', '3389', '4444']
                for port in suspicious_ports:
                    if f":{port}" in connections:
                        score -= 10
                        
        except Exception as e:
            logging.debug(f"Runtime security assessment error: {e}")
            score -= 5  # Penalty for inability to assess
        
        return max(0, score)
    
    async def collect_performance_metrics(self):
        """Collect comprehensive performance metrics"""
        containers = self.docker_client.containers.list()
        
        for container in containers:
            try:
                stats = container.stats(stream=False)
                
                # Calculate metrics
                cpu_percent = self.calculate_cpu_percent(stats)
                memory_percent = self.calculate_memory_percent(stats)
                
                # Store metrics
                timestamp = datetime.now()
                container_id = container.id
                
                if container_id not in self.performance_history:
                    self.performance_history[container_id] = []
                
                metrics = {
                    'timestamp': timestamp,
                    'cpu_percent': cpu_percent,
                    'memory_percent': memory_percent,
                    'network_rx': self.get_network_rx(stats),
                    'network_tx': self.get_network_tx(stats),
                    'disk_read': self.get_disk_read(stats),
                    'disk_write': self.get_disk_write(stats)
                }
                
                self.performance_history[container_id].append(metrics)
                
                # Keep only last 1000 metrics
                if len(self.performance_history[container_id]) > 1000:
                    self.performance_history[container_id] = self.performance_history[container_id][-1000:]
                
                # Store in Redis for real-time access
                await self.redis.hset(
                    f"performance:{container_id}",
                    mapping={
                        'cpu_percent': cpu_percent,
                        'memory_percent': memory_percent,
                        'timestamp': timestamp.isoformat()
                    }
                )
                
            except Exception as e:
                logging.error(f"Error collecting performance metrics for {container.name}: {e}")
    
    async def analyze_performance_trends(self):
        """Analyze performance trends and predict issues"""
        for container_id, history in self.performance_history.items():
            if len(history) < 10:  # Need minimum data points
                continue
            
            try:
                # Extract recent metrics
                recent_metrics = history[-60:]  # Last 60 data points
                cpu_values = [m['cpu_percent'] for m in recent_metrics]
                memory_values = [m['memory_percent'] for m in recent_metrics]
                
                # Predict future performance
                cpu_prediction = await self.predict_metric_trend(cpu_values)
                memory_prediction = await self.predict_metric_trend(memory_values)
                
                # Check for predicted issues
                if cpu_prediction > self.performance_model['cpu_threshold']:
                    await self.create_performance_alert(
                        container_id, 'cpu', cpu_prediction, 'predicted_high_cpu'
                    )
                
                if memory_prediction > self.performance_model['memory_threshold']:
                    await self.create_performance_alert(
                        container_id, 'memory', memory_prediction, 'predicted_high_memory'
                    )
                
                # Detect anomalies
                cpu_anomaly = self.detect_anomaly(cpu_values)
                memory_anomaly = self.detect_anomaly(memory_values)
                
                if cpu_anomaly:
                    await self.create_performance_alert(
                        container_id, 'cpu', cpu_values[-1], 'cpu_anomaly'
                    )
                
                if memory_anomaly:
                    await self.create_performance_alert(
                        container_id, 'memory', memory_values[-1], 'memory_anomaly'
                    )
                    
            except Exception as e:
                logging.error(f"Error analyzing performance trends for {container_id}: {e}")
    
    async def predict_metric_trend(self, values: List[float]) -> float:
        """Simple linear regression prediction"""
        if len(values) < 5:
            return values[-1] if values else 0
        
        x = np.arange(len(values))
        y = np.array(values)
        
        # Linear regression
        coeffs = np.polyfit(x, y, 1)
        
        # Predict next value
        next_x = len(values)
        prediction = coeffs[0] * next_x + coeffs[1]
        
        return max(0, prediction)
    
    def detect_anomaly(self, values: List[float]) -> bool:
        """Detect anomalies using statistical methods"""
        if len(values) < 10:
            return False
        
        mean = np.mean(values[:-1])  # Exclude current value
        std = np.std(values[:-1])
        current = values[-1]
        
        # Check if current value is more than 2 standard deviations from mean
        return abs(current - mean) > 2 * std
    
    async def execute_automated_responses(self):
        """Execute automated responses to alerts"""
        # Get active alerts
        alert_keys = await self.redis.keys("alert:*")
        
        for alert_key in alert_keys:
            alert_data = await self.redis.hgetall(alert_key)
            
            if not alert_data:
                continue
            
            alert_type = alert_data.get(b'type', b'').decode()
            container_id = alert_data.get(b'container_id', b'').decode()
            severity = alert_data.get(b'severity', b'').decode()
            
            # Execute response based on alert type and severity
            if alert_type == 'predicted_high_cpu' and severity == 'high':
                await self.scale_container_resources(container_id, cpu_increase=0.5)
            
            elif alert_type == 'predicted_high_memory' and severity == 'high':
                await self.scale_container_resources(container_id, memory_increase=512)
            
            elif alert_type == 'security_violation' and severity == 'critical':
                await self.quarantine_container(container_id)
            
            elif alert_type == 'cpu_anomaly':
                await self.restart_container_if_needed(container_id)
    
    async def scale_container_resources(self, container_id: str, cpu_increase: float = 0, memory_increase: int = 0):
        """Scale container resources"""
        try:
            container = self.docker_client.containers.get(container_id)
            
            # Get current resource limits
            host_config = container.attrs['HostConfig']
            current_cpu = host_config.get('CpuQuota', 100000) / 100000  # Convert to CPU count
            current_memory = host_config.get('Memory', 0)
            
            # Calculate new limits
            new_cpu = current_cpu + cpu_increase
            new_memory = current_memory + (memory_increase * 1024 * 1024)  # Convert MB to bytes
            
            # Update container (requires restart in Docker)
            logging.info(f"Scaling container {container_id}: CPU +{cpu_increase}, Memory +{memory_increase}MB")
            
            # In production, this would integrate with orchestration platform
            # For Docker Compose, would update the compose file and recreate
            
        except Exception as e:
            logging.error(f"Error scaling container {container_id}: {e}")
    
    async def quarantine_container(self, container_id: str):
        """Quarantine container by isolating it"""
        try:
            container = self.docker_client.containers.get(container_id)
            
            # Disconnect from all networks except monitoring
            networks = container.attrs['NetworkSettings']['Networks']
            for network_name in networks:
                if network_name != 'monitoring':
                    network = self.docker_client.networks.get(network_name)
                    network.disconnect(container)
            
            logging.critical(f"Container {container_id} quarantined due to security violation")
            
        except Exception as e:
            logging.error(f"Error quarantining container {container_id}: {e}")
    
    def calculate_cpu_percent(self, stats: Dict) -> float:
        """Calculate CPU percentage from stats"""
        cpu_delta = stats['cpu_stats']['cpu_usage']['total_usage'] - \
                   stats['precpu_stats']['cpu_usage']['total_usage']
        system_delta = stats['cpu_stats']['system_cpu_usage'] - \
                      stats['precpu_stats']['system_cpu_usage']
        
        if system_delta > 0 and cpu_delta > 0:
            return (cpu_delta / system_delta) * \
                   len(stats['cpu_stats']['cpu_usage']['percpu_usage']) * 100.0
        return 0.0
    
    def calculate_memory_percent(self, stats: Dict) -> float:
        """Calculate memory percentage from stats"""
        usage = stats['memory_stats']['usage']
        limit = stats['memory_stats']['limit']
        return (usage / limit) * 100.0 if limit > 0 else 0.0
    
    async def create_security_alert(self, container, security_score: float):
        """Create security alert"""
        alert_id = f"sec_{container.id}_{int(datetime.now().timestamp())}"
        
        severity = 'critical' if security_score < 50 else 'high' if security_score < 70 else 'medium'
        
        await self.redis.hset(
            f"alert:{alert_id}",
            mapping={
                'type': 'security_violation',
                'container_id': container.id,
                'container_name': container.name,
                'severity': severity,
                'security_score': security_score,
                'timestamp': datetime.now().isoformat()
            }
        )
        
        logging.warning(f"Security alert created for {container.name}: score {security_score}")
    
    async def create_performance_alert(self, container_id: str, metric_type: str, value: float, alert_type: str):
        """Create performance alert"""
        alert_id = f"perf_{container_id}_{int(datetime.now().timestamp())}"
        
        severity = 'high' if value > 90 else 'medium' if value > 80 else 'low'
        
        await self.redis.hset(
            f"alert:{alert_id}",
            mapping={
                'type': alert_type,
                'container_id': container_id,
                'metric_type': metric_type,
                'value': value,
                'severity': severity,
                'timestamp': datetime.now().isoformat()
            }
        )
        
        logging.warning(f"Performance alert created for {container_id}: {metric_type} = {value}")

async def main():
    """Main function"""
    config = {
        'security': {
            'alert_threshold': 70.0,
            'auto_quarantine': True
        },
        'performance': {
            'cpu_threshold': 80.0,
            'memory_threshold': 85.0,
            'auto_scaling': True
        }
    }
    
    # Save config
    with open('/tmp/ops-config.yaml', 'w') as f:
        yaml.dump(config, f)
    
    # Initialize and run
    ops_manager = IntelligentOpsManager('/tmp/ops-config.yaml')
    await ops_manager.initialize()
    
    logging.info("Intelligent Operations Platform started")
    await ops_manager.continuous_monitoring()

if __name__ == "__main__":
    logging.basicConfig(level=logging.INFO)
    asyncio.run(main())