# syntax=docker/dockerfile:1.7
#
# Image of vpcatlas: the command line and the dashboard, running as an unprivileged user.
# The entrypoint is the CLI and the default command serves the dashboard on 0.0.0.0:8080. Build from the
# repository root:
#
#   docker build -f deploy/Dockerfile -t vpcatlas:0.1.0 .
#
# Any command runs through the same image:
#
#   docker run --rm -p 8080:8080 vpcatlas:0.1.0                          # the dashboard
#   docker run --rm vpcatlas:0.1.0 --version
#   docker run --rm -v "$HOME/.aws:/home/atlas/.aws:ro" -v "$PWD/out:/data" \
#     vpcatlas:0.1.0 discover --profile audit --regions eu-west-1 --output-dir /data

ARG PYTHON_VERSION=3.12
# Digest of the base image (multi-arch index), looked up on 2026-10-17 with:
#   docker buildx imagetools inspect <image> --format '{{.Manifest.Digest}}'
ARG BASE_IMAGE_DIGEST=sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1

# ---- build: install the package and its dependencies into an isolated virtualenv ----------------
FROM python:${PYTHON_VERSION}-slim@${BASE_IMAGE_DIGEST} AS build

ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PIP_NO_CACHE_DIR=1 \
    PYTHONDONTWRITEBYTECODE=1

RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:${PATH}"

WORKDIR /src
COPY requirements.lock requirements-release.lock ./
RUN pip install --require-hashes -r requirements.lock
# The build backend comes from a hashed lock as well, in a folder the virtualenv never sees.
RUN pip install --require-hashes --target /tmp/build-tools -r requirements-release.lock
COPY pyproject.toml README.md LICENSE ./
COPY src ./src
RUN PYTHONPATH=/tmp/build-tools pip install --no-deps --no-build-isolation .

# ---- runtime: the virtualenv and nothing else ----------------------------------------------------
FROM python:${PYTHON_VERSION}-slim@${BASE_IMAGE_DIGEST} AS runtime

ARG VERSION=0.1.0
LABEL org.opencontainers.image.title="vpcatlas" \
      org.opencontainers.image.description="Read-only AWS network discovery: draw.io and Lucidchart diagrams, inventory and a live dashboard" \
      org.opencontainers.image.url="https://vpcatlas.com" \
      org.opencontainers.image.documentation="https://vpcatlas.com/docs/" \
      org.opencontainers.image.source="https://github.com/karina-pp/vpcatlas" \
      org.opencontainers.image.licenses="MIT" \
      org.opencontainers.image.version="${VERSION}"

RUN groupadd --system --gid 10001 atlas \
 && useradd --system --uid 10001 --gid atlas --create-home --home-dir /home/atlas --shell /usr/sbin/nologin atlas

COPY --from=build /opt/venv /opt/venv

# Regional STS endpoints: session tokens from the global endpoint are not valid in opt-in regions.
# VPCATLAS_REFRESH_SECONDS=0: one scan at start, then only manual refreshes; set it to rescan periodically.
ENV PATH="/opt/venv/bin:${PATH}" \
    PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PORT=8080 \
    VPCATLAS_REFRESH_SECONDS=0 \
    AWS_STS_REGIONAL_ENDPOINTS=regional

WORKDIR /home/atlas
USER 10001:10001
EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
  CMD ["python", "-m", "vpcatlas.dashboard.healthcheck"]

# One worker: the snapshot lives in the memory of the process. Scale out with VPCATLAS_SNAPSHOT_URI, not workers.
ENTRYPOINT ["vpcatlas"]
CMD ["serve", "--host", "0.0.0.0", "--port", "8080"]
