# syntax=docker/dockerfile:1.7
FROM python@sha256:9534e5a8e315485d4061ed659af0fd78a284c015f9b73661b41d6bab25604534 AS trust-store

FROM ubuntu@sha256:513c074113a871b51a8d16ab445c88779d6452d937a164fb5cc479f32668a41d

ARG NMAP_VERSION=7.98+dfsg-1
ARG UBUNTU_SNAPSHOT=20260914T000000Z

# The minimal Ubuntu image does not ship a populated CA bundle. Bootstrap it from another
# digest-pinned official image so the immutable snapshot remains TLS-verified from the first
# request; APT independently verifies the Ubuntu archive signature.
COPY --from=trust-store /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt

# The package version and snapshot timestamp are reviewable inputs. A build fails rather than
# silently accepting a newer scanner when the pinned package is no longer available.
RUN apt-get update --snapshot "${UBUNTU_SNAPSHOT}" \
    && DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends \
        --snapshot "${UBUNTU_SNAPSHOT}" \
        nmap="${NMAP_VERSION}" \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* \
    && nmap --version

LABEL org.opencontainers.image.title="MatrixRecon Nmap sandbox" \
      org.opencontainers.image.source="https://github.com/matrix-tech/MatrixRecon" \
      org.opencontainers.image.version="7.98" \
      org.opencontainers.image.base.digest="sha256:513c074113a871b51a8d16ab445c88779d6452d937a164fb5cc479f32668a41d"

USER 65532:65532
ENTRYPOINT ["nmap"]
