feat(docker): add REST API live reload

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22
+FROM node:22 AS base
 
 # Define build arguments
 ARG VERSION=dev
@@ -26,15 +26,27 @@ WORKDIR /usr/src/app
 # where available (npm@5+)
 COPY package*.json ./
 
-# Install the app dependencies
-RUN npm ci --only=production
-
-# Copy app source
-COPY . .
-
 # Set version as environment variable for runtime access
 ENV APP_VERSION=${VERSION} \
     GIT_COMMIT=${REVISION} \
     BUILD_DATE=${BUILDTIME}
 
-CMD [ "npm", "start" ]
+FROM base AS dev
+
+# Install development dependencies.
+RUN npm ci
+
+# Copy app source
+COPY . .
+
+CMD [ "node", "./bin/www" ]
+
+FROM base AS production
+
+# Install the app dependencies
+RUN npm ci --omit=dev
+
+# Copy app source
+COPY . .
+
+CMD [ "npm", "start" ]

docs/admin/authentication/configuration.md

@@ -89,6 +89,11 @@ docker compose restart rest-api
 npm start
 ```
 
+For Docker Compose environment-file changes, recreate the container with
+`docker compose up -d --force-recreate rest-api` to load the updated environment.
+See the [deployment configuration guide](https://github.com/mitre-attack/attack-workbench-deployment/blob/main/docs/configuration.md#rest-api-configuration-files)
+for configuration file locations and details on applying changes.
+
 ### Step 4: Verify Configuration Load
 
 Check the REST API logs during startup to confirm the configuration was loaded successfully:

docs/admin/authentication/testing-verification.md

@@ -13,6 +13,9 @@ Before testing, ensure you have:
 
 ## Verification Steps
 
+For details on configuring REST API configuration files and container logging,
+see the [deployment configuration guide](https://github.com/mitre-attack/attack-workbench-deployment/blob/main/docs/configuration.md#rest-api-configuration-files).
+
 ### Step 1: Check REST API Logs
 
 When the REST API starts, it should log information about the authentication configuration.

docs/admin/configuration.md

@@ -30,8 +30,15 @@ JSON configuration files, or a combination of both.
     - [Collection Indexes](#collection-indexes)
     - [Configuration Files](#configuration-files)
       - [Allowed Values](#allowed-values)
+        - [Initialization and the JSON file](#initialization-and-the-json-file)
+        - [Managing a configuration](#managing-a-configuration)
+        - [Adding values](#adding-values)
+        - [ADM version and enforcement](#adm-version-and-enforcement)
+        - [Legacy invalid settings](#legacy-invalid-settings)
+        - [API](#api)
       - [Static Marking Definitions](#static-marking-definitions)
     - [ATT\&CK Specific](#attck-specific)
+  - [STIX graph-write exclusion](#stix-graph-write-exclusion)
   - [Additional Resources](#additional-resources)
 
 ---
@@ -111,6 +118,10 @@ JSON configuration files are recommended for complex configurations, especially
    JSON_CONFIG_PATH=/path/to/config.json
    ```
 
+The API reads the JSON file during startup. Restart the process after changing
+the file. For container configuration and restart procedures, see the
+[deployment configuration guide](https://github.com/mitre-attack/attack-workbench-deployment/blob/main/docs/configuration.md#rest-api-configuration-files).
+
 ### Configuration Precedence
 
 When both environment variables and JSON configuration are used:

docs/legacy/docker.md

@@ -1,8 +1,7 @@
 # Standalone Docker Installation
 
-The ATT&CK Workbench Frontend project includes a `docker-compose.yml` file that can be used to install all of the ATT&CK Workbench components as part of a Docker Compose installation.
-
-This document describes an alternate method of installing the ATT&CK Workbench REST API service in a Docker container without using Docker Compose.
+This guide covers standalone Docker commands. For a complete Workbench deployment
+with Docker Compose, use the [deployment repository](https://github.com/mitre-attack/attack-workbench-deployment).
 
 ## Create a Docker Image for the REST API
 

template.env

@@ -1,3 +1,11 @@
+# Template-Version: 1.0
+# Template-Updated: 2026-10-11
+# Template-Source: attack-workbench-rest-api/template.env
+#
+# Changelog
+# ---------
+# - 1.0 (2026-10-11): Introduce template metadata
+
 # Attack Workbench REST API - Environment Configuration Template
 # Guidance:
 # - Booleans: use true or false
@@ -11,7 +19,7 @@
 # Database (REQUIRED)
 # DATABASE_URL (string) - MongoDB connection string
 # Example (Docker):
-#DATABASE_URL=mongodb://attack-workbench-database/attack-workspace
+#DATABASE_URL=mongodb://mongodb/attack-workspace
 # Example (local):
 #DATABASE_URL=mongodb://localhost:27017/attack-workspace
 DATABASE_URL=
@@ -51,6 +59,14 @@ DATABASE_URL=
 # Configuration Files
 # JSON_CONFIG_PATH (string) - Path to a JSON file with additional configuration.
 # Use this to provide arrays for service accounts and OIDC clients
+#
+# Some example values which align to some sample configurations which can be found here:
+#     https://github.com/mitre-attack/attack-workbench-rest-api/tree/main/resources/sample-configurations
+#
+#     ./resources/collection-manager-apikey.json
+#     ./resources/collection-manager-oidc-keycloak.json
+#     ./resources/collection-manager-oidc-okta.json
+#
 # Default: empty (disabled)
 #JSON_CONFIG_PATH=
 
@@ -62,11 +78,23 @@ DATABASE_URL=
 # Default: ./app/lib/default-static-marking-definitions/
 #WB_REST_STATIC_MARKING_DEFS_PATH=./app/lib/default-static-marking-definitions/
 
+# WB_REST_STATIC_BYPASS_RULES_PATH (string) - Default validation bypass rules loaded at startup
+# Default: ./app/lib/default-bypass-rules.json
+#WB_REST_STATIC_BYPASS_RULES_PATH=./app/lib/default-bypass-rules.json
+
 # Scheduler
 # ENABLE_SCHEDULER (bool) - Enable background scheduler
 # Default: true
 #ENABLE_SCHEDULER=true
 
+# SYNC_COLLECTION_INDEXES_CRON (string) - Cron schedule for polling collection indexes (process timezone)
+# Default: * * * * * (every minute); disabled when ENABLE_SCHEDULER=false
+#SYNC_COLLECTION_INDEXES_CRON=* * * * *
+
+# CHECK_WIP_ATTACK_IDS_CRON (string) - Cron setting for WIP ATT&CK-ID checks (currently unused by scheduler)
+# Default: 0 * * * * (hourly); no current task consumes this setting
+#CHECK_WIP_ATTACK_IDS_CRON=0 * * * *
+
 # VIRTUAL_TRACK_SCHEDULES_CRON (string) - Reconcile virtual-track schedules
 # Discovers new cron schedules, recovers due dates, and retries failed runs.
 # Standard 5-field cron syntax, interpreted in UTC.