Dockerfile.heavy

# Heavy POC image: socket-basics plus a pinned stable Python Socket CLI.
ARG PYTHON_VERSION=3.12
ARG TRUFFLEHOG_VERSION=3.96.0
ARG UV_VERSION=0.12.1
ARG OPENGREP_VERSION=v1.26.0
ARG SOCKET_NPM_CLI_VERSION=1.1.165
ARG SOCKET_PYTHON_CLI_VERSION=2.11.3
# Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915

FROM ${TRIVY_IMAGE} AS trivy
FROM trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} AS trufflehog
FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv

FROM python:${PYTHON_VERSION}-slim AS opengrep-installer
ARG OPENGREP_VERSION
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && apt-get install -y --no-install-recommends \
      curl ca-certificates bash
RUN curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh \
    | bash -s -- -v "${OPENGREP_VERSION}"

FROM python:${PYTHON_VERSION}-slim AS runtime

WORKDIR /socket-basics

COPY --from=uv /uv /uvx /bin/
COPY --from=trivy /usr/local/bin/trivy /usr/local/bin/trivy
COPY --from=trufflehog /usr/bin/trufflehog /usr/local/bin/trufflehog
COPY --from=opengrep-installer /root/.opengrep /root/.opengrep

# ca-certificates must be 20250419+deb13u1 or newer, which drops the roots the
# compromised eMudhra intermediates chain to.
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && apt-get install -y --no-install-recommends \
      curl git wget ca-certificates \
    && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1
# pip checks certificates against its own vendored CA bundle, not the system
# store, and the base image's pip trusts the compromised intermediates. 26.2.2
# vendors certifi 2026.10.19. Upgrade it against the system store fixed above.
RUN python -m pip install --no-cache-dir --cert /etc/ssl/certs/ca-certificates.crt --upgrade "pip>=26.2.2" \
    && python -c 'import sys, pip; sys.exit(tuple(map(int, pip.__version__.split(".")[:3])) < (26, 2, 2))'
# Node rejects the compromised eMudhra intermediates from 22.23.4.
RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
    && apt-get install -y nodejs \
    && node -e 'const [a,b,c]=process.versions.node.split(".").map(Number); process.exit(a>22||(a===22&&(b>23||(b===23&&c>=4)))?0:1)'
ARG SOCKET_NPM_CLI_VERSION
RUN --mount=type=cache,target=/root/.npm \
    npm install -g "socket@${SOCKET_NPM_CLI_VERSION}"

COPY socket_basics  /socket-basics/socket_basics
COPY pyproject.toml README.md LICENSE uv.lock /socket-basics/

ENV UV_LINK_MODE=copy
ARG SOCKET_PYTHON_CLI_VERSION
# The Python CLI runs on the system interpreter, not the locked venv, so floor
# certifi there too (2026.10.19 drops the compromised eMudhra roots).
RUN --mount=type=cache,target=/root/.cache/uv \
    pip install -e . \
    && uv sync --frozen --no-dev \
    && pip install --no-cache-dir "socketsecurity==${SOCKET_PYTHON_CLI_VERSION}" "certifi>=2026.10.19"

COPY scripts/docker-heavy-entrypoint.sh /usr/local/bin/docker-heavy-entrypoint.sh
RUN chmod +x /usr/local/bin/docker-heavy-entrypoint.sh

ARG SOCKET_BASICS_VERSION=dev
ARG VCS_REF=unknown
ARG BUILD_DATE=unknown
ARG TRUFFLEHOG_VERSION
ARG OPENGREP_VERSION
ARG SOCKET_NPM_CLI_VERSION
ARG SOCKET_PYTHON_CLI_VERSION
LABEL org.opencontainers.image.title="Socket Basics Heavy" \
      org.opencontainers.image.source="https://github.com/SocketDev/socket-basics" \
      org.opencontainers.image.version="${SOCKET_BASICS_VERSION}" \
      org.opencontainers.image.created="${BUILD_DATE}" \
      org.opencontainers.image.revision="${VCS_REF}" \
      com.socket.python-cli-version="${SOCKET_PYTHON_CLI_VERSION}" \
      com.socket.npm-cli-version="${SOCKET_NPM_CLI_VERSION}" \
      com.socket.trufflehog-version="${TRUFFLEHOG_VERSION}" \
      com.socket.opengrep-version="${OPENGREP_VERSION}"

ENV PATH="/socket-basics/.venv/bin:/root/.opengrep/cli/latest:/usr/local/bin:$PATH"

ENTRYPOINT ["/usr/local/bin/docker-heavy-entrypoint.sh"]