# Dockerfile — Python runner for Day-4 Detection Engineering lab
# Base image pinned by index-digest (ADR-6).
# Re-resolve: docker buildx imagetools inspect python:3.12-slim --format '{{.Manifest.Digest}}'
FROM python:3.12-slim@sha256:423ed6ab25b1921a477529254bfeeabf5855151dc2c3141699a1bfc852199fbf

WORKDIR /workspace

# Install system packages:
#   curl     — for debugging convenience (e.g. testing Ollama from inside the container)
#   suricata — IDS engine used ONLY for `suricata -T` rule syntax validation.
#              NEVER run with -i / -r / live capture in this lab (ADR-5).
#
# suricata 7.0.x is available in Debian bookworm repos.
# Installed at BUILD time so the binary is available offline at demo time (ADR-5).
RUN apt-get update \
    && apt-get install -y --no-install-recommends curl suricata \
    && rm -rf /var/lib/apt/lists/*

# Install Python dependencies (layer-cached unless requirements.txt changes).
# Includes:
#   sigma-cli      — `sigma check` command for Sigma rule validation
#   pyyaml         — YAML parsing for Sigma rule inspection
#   httpx          — HTTP client for Ollama API calls
#   rich           — terminal output formatting
COPY app/requirements.txt ./requirements.txt
RUN pip install --no-cache-dir -r requirements.txt

# Bake app + data + prompts into the image so it works standalone.
# Compose volume mounts override these at runtime (edits without rebuild).
COPY app/ ./app/
COPY data/ ./data/
COPY prompts/ ./prompts/

# Default: full generate → validate → repair loop.
# Override at runtime:
#   docker compose run --rm runner python app/detection_eng.py --sigma-only
#   docker compose run --rm runner python app/detection_eng.py --suricata-only
CMD ["python", "app/detection_eng.py"]
