Install notes for this on Rocky Linux 9 with Podman instead of Docker, with a PostgreSQL 16 database.

[sharper73]

Any comments welcome. There is definitely room for improvement.
I'm doing this inside a semi-air-gapped environment, so we need to copy things in by hand
and the usual repositories won't work. I'm using podman instead of Docker.

Install docker-compose plugin (Please use the latest version)
wget "https://download.docker.com/linux/rhel/9/x86_64/stable/Packages/docker-compose-plugin-5.0.2-1.el9.x86_64.rpm"
scp username@desktop.example.edu:/home/username/docker-compose-plugin-5.0.2-1.el9.x86_64.rpm .
dnf install docker-compose-plugin-5.0.2-1.el9.x86_64.rpm

Here's my script to create a podman service account and make sure it uses "pasta" networking.
This is the default after podman 5.x. On Rocky Linux useradd populates subuid/subgid automatically.
podmansa.sh:

#!/bin/bash

dnf -y install systemd-container passt
/usr/sbin/useradd podman
/usr/bin/loginctl enable-linger podman

# this ensures we are using passta network stack
CONFIG_DIR="/home/podman/.config/containers"
CONFIG_FILE="$CONFIG_DIR/containers.conf"
mkdir -p "$CONFIG_DIR"

# 2. Check if the file exists; if not, create it with the header
if [ ! -f "$CONFIG_FILE" ]; then
    cat <<EOF > "$CONFIG_FILE"
[network]
default_rootless_network_cmd = "pasta"
EOF
    echo "Created new config at $CONFIG_FILE"
else
    # 3. If file exists, check if 'default_rootless_network_cmd' is already set
    if grep -q "default_rootless_network_cmd" "$CONFIG_FILE"; then
        echo "Network driver already configured in $CONFIG_FILE. No changes made."
    else
        # 4. Check if [network] section exists to append under it,
        # otherwise append both section and setting
        if grep -q "\[network\]" "$CONFIG_FILE"; then
            sed -i '/\[network\]/a default_rootless_network_cmd = "pasta"' "$CONFIG_FILE"
            echo "Added pasta driver to existing [network] section in $CONFIG_FILE"
        else
            cat <<EOF >> "$CONFIG_FILE"

[network]
default_rootless_network_cmd = "pasta"
EOF
            echo "Appended [network] section with pasta driver to $CONFIG_FILE"
        fi
    fi
fi

/usr/bin/chown -R podman: /home/podman/.config

------------------------------------------------------- END FILE

su - podman
systemctl --user enable --now podman.service

# The podman service is required to use "podman compose" functionality
# the user systemd podman.service should now be persistent
# I also created a systemd --user service to run this compose stack
# ~/.config/systemd/user/ciso-assistant.service:

[Unit]
Description=CISO Assistant Podman Compose Stack
After=network-online.target

[Service]
Type=simple
WorkingDirectory=/home/podman/ciso-assistant-community

# 1. Hydrate the .env file dynamically from the Podman secret
ExecStartPre=/bin/bash -c 'printf "DB_PASSWORD=%s\n" "$$(/usr/bin/podman secret inspect --showsecret --format \'{{.SecretData}}\' db_pass)" > .env && chmod 600 .env'

# Clean up any orphaned containers before starting
ExecStartPre=-/usr/bin/podman compose down
# Start the stack in the foreground so systemd captures the logs
ExecStart=/usr/bin/podman compose up
# Graceful shutdown
ExecStop=/usr/bin/podman compose down
Restart=always
RestartSec=10

[Install]
WantedBy=default.target

------------------------------------- END FILE
# systemctl --user daemon-reload
# systemctl --user enable --now ciso-assistant.service
# Do this AFTER you configure things by hand, as the docker-compose.sh
# script is what populates the password into the .env file

git clone https://github.com/intuitem/ciso-assistant-community.git
dnf install s-nail postfix
cd ciso-assistant-community

As I can't pull the container images directly, pull and save them outside the environment
podman pull ghcr.io/intuitem/ciso-assistant-community/backend:latest
podman pull ghcr.io/intuitem/ciso-assistant-community/frontend:latest
podman pull docker.io/library/postgres:16-alpine
podman pull docker.io/library/caddy:2.10.0
podman save -o backend.tar ghcr.io/intuitem/ciso-assistant-community/backend:latest
podman save -o frontend.tar ghcr.io/intuitem/ciso-assistant-community/frontend:latest
podman save -o postgres.tar docker.io/library/postgres:16-alpine
podman save -o caddy.tar docker.io/library/caddy:2.10.0

copy in and load the images on the "secure" vm
for img in *.tar; do podman load -i "$img"; done

replace docker-compose.sh and docker-compose.yml with these ones. I made the shell script idempotent,
and changed the compose stack to use postgresql, also containerized, and enabled email
(configuring postfix is outside the scope of this guide) I'm using podman secrets for the password,
but in the end just stuck the variable in the shell script into a secure ".env" file. Should fix later.
For now you can follow along and do
echo "YourStrongPassword" | podman secret create db_pass -
For the DJANGO_SECRET_KEY you can generate a good key with
openssl rand -base64 48
I also tell this to never try to update the images, as it can't anyway.
To get to the postfix MTA outside the container stack I use
"host.containers.internal" for the email server. I also had to configure postfix/main.cf
to listen globally (inet_interfaces = all) and accept unauthenticated relay from the Podman subnet
(mynetworks appended with 127.0.0.0/8 and 10.0.0.0/8).
and set an appropriate "relayhost = yourmailserver.edu" in main.cf
Firewalld configured with a rich rule to permanently allow TCP Port 25 traffic explicitly from the 10.0.0.0/8 source block.
I'm using an InCommon cert with the cert chain for this, but had to move the last cert to the beginning of the PEM file
to get Caddy to recognize that the key was correct for this cert/chain file.
Appended the :Z,U flags to all local volume mounts. :Z automatically provisions a private SELinux context, and :U
recursively chowns the directory to match the container's user namespace.
If you'd like to set passwords for users and securely share them out-of-band, you can do so like this
podman exec -it backend poetry run python manage.py changepassword <username>
Here's the Config files:

docker-compose.sh:

#!/bin/bash

echo "Starting CISO Assistant stack..."

# 1. Inject the secret (Mandatory to bypass the blank password bug)
DB_PASS=$(podman secret inspect --showsecret --format "{{.SecretData}}" db_pass)
if [ -z "$DB_PASS" ]; then
    echo "Error: Could not retrieve db_pass from podman secrets."
    exit 1
fi
printf "DB_PASSWORD=%s\n" "$DB_PASS" > .env

/usr/bin/chmod 600 .env

# 2. Start the stack (Removed 'pull' to respect the air-gap)
podman compose up -d

# 3. The Vendor's Wait Loop (Slightly adjusted for direct podman exec)
echo "Waiting for CISO Assistant backend to be ready (Migrations may take a minute)..."
until podman exec backend curl -s -f http://localhost:8000/api/health/ >/dev/null 2>&1; do
  echo "Backend is not ready - waiting 10s..."
  sleep 10
done

echo -e "\nBackend is ready and connected to Postgres!"
# 4. Safe prompt for Admin creation
echo "------------------------------------------------------"
echo "If this is your FIRST time booting, create your admin account by running:"
echo "podman exec -it backend poetry run python manage.py createsuperuser"
echo "------------------------------------------------------"
echo "You can now access CISO Assistant at https://ciso-asst.example.edu:8443"

---------------------------------------- END FILE

docker-compose.yml:

version: '3.8'

services:
  db:
    container_name: db
    image: docker.io/library/postgres:16-alpine
    pull_policy: never
    restart: always
    environment:
      - POSTGRES_DB=ciso_assistant
      - POSTGRES_USER=ciso_user
      - POSTGRES_PASSWORD=${DB_PASSWORD}
    volumes:
      - ./postgres_data:/var/lib/postgresql/data:Z,U

  backend:
    container_name: backend
    image: ghcr.io/intuitem/ciso-assistant-community/backend:latest
    pull_policy: never
    restart: always
    depends_on:
      - db
    environment:
      - DJANGO_SECRET_KEY=YourVerySecretGeneratedKeyHere
      - ENABLE_SANDBOX=True
      - ALLOWED_HOSTS=backend,localhost,ciso-asst.example.edu
      - CISO_ASSISTANT_URL=https://ciso-asst.example.edu:8443
      - DATABASE_TYPE=postgres
      - DB_ENGINE=django.db.backends.postgresql
      - DB_HOST=db
      - DB_PORT=5432
      - POSTGRES_NAME=ciso_assistant
      - POSTGRES_USER=ciso_user
      - POSTGRES_PASSWORD=${DB_PASSWORD}
      - DB_PASSWORD=${DB_PASSWORD}
      - DATABASE_URL=postgres://ciso_user:${DB_PASSWORD}@db:5432/ciso_assistant
      - EMAIL_HOST=host.containers.internal
      - EMAIL_PORT=25
      - EMAIL_USE_TLS=False
      - DEFAULT_FROM_EMAIL=ciso-assistant@ciso-asst.example.edu
    volumes:
      - ./db:/code/db:Z,U
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://backend:8000/api/health/ || exit 1"]
      interval: 10s
      timeout: 10s
      retries: 30
      start_period: 150s

  huey:
    container_name: huey
    image: ghcr.io/intuitem/ciso-assistant-community/backend:latest
    pull_policy: never
    depends_on:
        backend:
            condition: service_healthy
    restart: always
    environment:
      - DJANGO_SECRET_KEY=YourVerySecretGeneratedKeyHere
      - ENABLE_SANDBOX=True
      - ALLOWED_HOSTS=backend,localhost
      - CISO_ASSISTANT_URL=https://ciso-asst.example.edu:8443
      - DATABASE_TYPE=postgres
      - DB_HOST=db
      - DB_PORT=5432
      - POSTGRES_NAME=ciso_assistant
      - POSTGRES_USER=ciso_user
      - POSTGRES_PASSWORD=${DB_PASSWORD}
      - DB_PASSWORD=${DB_PASSWORD}
      - EMAIL_HOST=host.containers.internal
      - EMAIL_PORT=25
      - EMAIL_USE_TLS=False
      - DEFAULT_FROM_EMAIL=ciso-assistant@ciso-asst.example.edu
    volumes:
      - ./db:/code/db:Z,U
    entrypoint:
      - /bin/sh
      - -c
      - "poetry run python manage.py run_huey -w 2 --scheduler-interval 60"

  frontend:
    container_name: frontend
    image: ghcr.io/intuitem/ciso-assistant-community/frontend:latest
    pull_policy: never
    restart: always
    environment:
      - PUBLIC_BACKEND_API_URL=http://backend:8000/api
      - PUBLIC_BACKEND_API_EXPOSED_URL=https://ciso-asst.example.edu:8443/api
      - ORIGIN=https://ciso-asst.example.edu:8443
    depends_on:
        backend:
            condition: service_healthy

  caddy:
    container_name: caddy
    image: docker.io/library/caddy:2.10.0
    pull_policy: never
    restart: unless-stopped
    ports:
      - 8443:8443
    volumes:
      - ./caddy_data:/data
      - ./certs:/etc/caddy/certs:ro
    command: |
      sh -c 'echo "ciso-asst.example.edu:8443 {
      reverse_proxy /api/* backend:8000
      reverse_proxy /* frontend:3000
      tls /etc/caddy/certs/ciso-asst.example.edu.pem /etc/caddy/certs/ciso-asst.example.edu.key
      }" > Caddyfile && caddy run'

------------------------------------------------------- END FILE

[sharper73]

I should probably change the service file to use the docker-compose.sh but have not yet.

EDIT
I copied the env population to the user service that starts this stack. So docker-compose.sh is really only useful to give you the line at the end to set up the superuser, and in either case you have to set the db_password in podman secrets first.