#!/usr/bin/env bash
# SAFE DEFENSIVE VALIDATOR — DOCKER / CONTAINER SURFACE PROOF
#
# Purpose: Lists local Docker images, containers, and versions using safe
#          docker CLI commands (no run, no pull, no build).
#
# Safety: Read-only docker commands only.
#
# Generated by Vigil safe-poc-generator (Phase 1, template A).

set -euo pipefail

STARTED=$(date -u +%Y-%m-%dT%H:%M:%SZ)

echo '{
  "validator": "docker-inventory-validator",
  "schemaVersion": "1.0.0",
  "generatedBy": "Vigil safe-poc-generator (Phase 1, template A)",
  "startedAt": "'"$STARTED"'",
  "dockerVersion": "'$(docker --version 2>/dev/null || echo "not installed")'",
  "images": [],'

IMAGES=$(docker images --format "{{.Repository}}:{{.Tag}}" 2>/dev/null | head -10 | sed 's/"/\\"/g' || true)
echo '  "imageSample": ['"$(echo "$IMAGES" | sed 's/^/"/;s/$/"/' | paste -sd, -)"'],
  "containers": "'$(docker ps --format "{{.Names}}" 2>/dev/null | wc -l | tr -d ' ' || echo 0)'",
  "completedAt": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
  "conclusion": "Docker surface inventoried locally. Review for outdated or privileged containers."
}'
exit 0