# Dockerfile — Python runner for Day-4 MCP SecOps lab
# Base image pinned by index-digest (ADR-6).
# Re-resolve: docker buildx imagetools inspect python:3.12-slim --format '{{.Manifest.Digest}}'
FROM python:3.12-slim@sha256:423ed6ab25b1921a477529254bfeeabf5855151dc2c3141699a1bfc852199fbf

WORKDIR /workspace

# Install system packages:
#   curl     — for debugging convenience (e.g. testing Ollama from inside the container)
#   suricata — IDS engine for Exercise B (suricata -T rule syntax validation, no live capture)
#
# suricata 7.0.x is available in Debian bookworm repos.
# Installed at BUILD time so the binary is available offline at demo time (ADR-5).
RUN apt-get update \
    && apt-get install -y --no-install-recommends curl suricata \
    && rm -rf /var/lib/apt/lists/*

# Install Python dependencies (layer-cached unless requirements.txt changes).
# Includes:
#   mcp>=1.9,<2    — FastMCP server (SSE transport) + SSE client (2025-11-25 spec)
#   sigma-cli      — sigma check command for Sigma rule validation (Exercise A)
#   httpx          — HTTP client for Ollama API calls
#   rich           — terminal output formatting
#   pyyaml         — YAML parsing for Sigma rules
COPY app/requirements.txt ./requirements.txt
RUN pip install --no-cache-dir -r requirements.txt

# Bake app + data + prompts into the image so it works standalone.
# Compose volume mounts override these at runtime (edits without rebuild).
COPY app/ ./app/
COPY data/ ./data/
COPY prompts/ ./prompts/

# Default: MCP server (SSE transport on port 8000).
# Override at runtime:
#   docker compose run --rm runner python app/mcp_demo.py
#   docker compose run --rm runner python app/sigma_demo.py
#   docker compose run --rm runner python app/cve_triage.py
CMD ["python", "app/mcp_server.py"]
