FROM python:3.12-slim

ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1 \
    DOCKER_HOST=unix:///var/run/docker.sock

# nmap for the attack-surface scan; trivy for container CVEs (it reaches the
# Docker daemon via DOCKER_HOST, so no docker CLI is needed). The collector
# itself is pure stdlib Python — no pip deps.
RUN apt-get update \
 && apt-get install -y --no-install-recommends nmap ca-certificates wget \
 && wget -qO- https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
      | sh -s -- -b /usr/local/bin \
 && apt-get purge -y wget && apt-get autoremove -y \
 && rm -rf /var/lib/apt/lists/*

WORKDIR /app
COPY . .

ENTRYPOINT ["python", "collector.py"]