# syntax=docker/dockerfile:1.7
#
# Submit Shield SDK — folder-watcher image.
#
# Run:
#   docker run --rm \
#     -e SUBMITSHIELD_API_URL=https://api.submitshield.health \
#     -e SUBMITSHIELD_CUSTOMER_SECRET=$(cat /secure/secret) \
#     -e SUBMITSHIELD_ATTESTATION_LOG=/var/submitshield/attestation.jsonl \
#     -v /var/spool/claims:/inbox \
#     -v /var/spool/claims/verdicts:/outbox \
#     -v /var/submitshield:/var/submitshield \
#     submitshield/sdk:latest
#
# The container watches /inbox for new files, de-identifies each locally,
# posts to the configured Submit Shield API, and writes the verdict JSON to
# /outbox. Files with errors land in /inbox/errors. The attestation log
# is an append-only JSONL proof that no PHI left the container.
#
# Security:
#   * Runs as non-root user `submitshield` (uid 10001).
#   * No secrets baked in — SUBMITSHIELD_CUSTOMER_SECRET is passed at
#     runtime via env or a Docker secret.
#   * Python 3.12-slim base for minimal CVE surface.
#   * Multi-stage build trims pip cache from the final layer.

FROM python:3.12-slim AS build

WORKDIR /build

# Install build tools only in the build stage — final image stays slim.
RUN apt-get update \
    && apt-get install -y --no-install-recommends build-essential \
    && rm -rf /var/lib/apt/lists/*

# Copy the SDK source and install into an isolated prefix that we can
# copy whole into the final stage.
COPY pyproject.toml README.md ./
COPY submitshield_sdk ./submitshield_sdk

RUN pip install --no-cache-dir --prefix=/install .

# ----------------------------------------------------------------------

FROM python:3.12-slim

LABEL org.opencontainers.image.title="Submit Shield SDK"
LABEL org.opencontainers.image.description="De-identifying folder watcher for Submit Shield"
LABEL org.opencontainers.image.vendor="Submit Shield"
LABEL org.opencontainers.image.licenses="Proprietary"
LABEL org.opencontainers.image.source="https://github.com/moisemmedina/submitshield"

# Non-root user
RUN groupadd --system --gid 10001 submitshield \
    && useradd --system --uid 10001 --gid submitshield \
         --home /home/submitshield --shell /usr/sbin/nologin submitshield \
    && mkdir -p /inbox /outbox /var/submitshield /home/submitshield/.submitshield \
    && chown -R submitshield:submitshield /inbox /outbox /var/submitshield /home/submitshield

# Copy only the installed prefix from the build stage
COPY --from=build /install /usr/local

COPY docker/entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

USER submitshield:submitshield
WORKDIR /home/submitshield

ENV PYTHONUNBUFFERED=1 \
    SUBMITSHIELD_API_URL="https://api.submitshield.health" \
    SUBMITSHIELD_INBOX=/inbox \
    SUBMITSHIELD_OUTBOX=/outbox \
    SUBMITSHIELD_ERRORS=/inbox/errors \
    SUBMITSHIELD_ATTESTATION_LOG=/var/submitshield/attestation.jsonl \
    SUBMITSHIELD_WATCH_INTERVAL=5

HEALTHCHECK --interval=60s --timeout=5s --start-period=5s --retries=3 \
    CMD submitshield version --no-update-check > /dev/null 2>&1 || exit 1

ENTRYPOINT ["/entrypoint.sh"]
