"""Config-drift source: read-only Docker socket -> 0.0.0.0 binds, privileged, rw-socket mounts."""
from soc import finding

from . import _docker


def run():
    if not _docker.available():
        return None  # socket not mounted -> skip
    conts = _docker.get("/containers/json") or []

    findings = []
    for c in conts:
        name = (c.get("Names") or ["?"])[0].lstrip("/")
        cid = c.get("Id", "")[:12]
        try:
            d = _docker.get(f"/containers/{cid}/json")
        except Exception:
            continue
        hc = d.get("HostConfig", {}) or {}

        # Ports published on all interfaces (0.0.0.0 / ::) — i.e. exposed off-host.
        exposed = []
        for port, binds in ((d.get("NetworkSettings", {}) or {}).get("Ports") or {}).items():
            for b in (binds or []):
                if b.get("HostIp") in ("0.0.0.0", "::", ""):
                    exposed.append(f"{b.get('HostIp') or '0.0.0.0'}:{b.get('HostPort')}->{port}")
        if exposed:
            findings.append(finding(
                f"drift-bind-{name}", "high", f"{name} publishes ports on all interfaces",
                host=name, evidence="; ".join(exposed),
                impact=["reachable from outside the host, bypassing the reverse proxy"],
                fix=["bind to 127.0.0.1, or drop host ports and route via the proxy"]))

        if hc.get("Privileged"):
            findings.append(finding(
                f"drift-priv-{name}", "high", f"{name} runs --privileged",
                host=name, evidence="Privileged=true",
                impact=["a container escape becomes full host root"],
                fix=["drop --privileged; grant only the specific capabilities needed"]))

        for m in (d.get("Mounts") or []):
            if m.get("Source") == "/var/run/docker.sock" and m.get("RW"):
                findings.append(finding(
                    f"drift-sock-{name}", "high", f"{name} mounts the Docker socket read-write",
                    host=name, evidence="/var/run/docker.sock (rw)",
                    impact=["the container can control the host's Docker = host root"],
                    fix=["mount it :ro, or put a scoped socket-proxy in front"]))

    return {
        "scope": f"{len(conts)} container(s)",
        "findings": findings,
        "good": [] if findings else ["No 0.0.0.0 binds, privileged, or rw-socket containers"],
    }