# Observer — a passive vantage-point spy (ISS-0117).
#
# Carries the full probe toolbox (dig, curl, openssl, nc, ping, ip) so a single image
# can be injected at any network location and assert resolve/reach/TLS from that seat.
# It runs NO services and deploys NO modules — it never perturbs the system under test.
# Its faithfulness as a vantage comes from the routing profile installed at startup
# (see config/routing/observer-setup.sh), driven by the OBSERVER_* env the compose
# generator sets per vantage.
FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02

ENV DEBIAN_FRONTEND=noninteractive

# `--no-install-recommends` is load-bearing: `wireguard-tools` Recommends
# `wireguard-modules | wireguard-dkms`, which apt satisfies with a realtime
# KERNEL plus `linux-firmware` (1.1 GB). Measured 2026-09-05: 1.83 GB of this
# image's 1.9 GB was that, for a probe toolbox that runs no kernel at all.
# See the same note in Dockerfile.target-machine.
#
# `iptables` is named because it used to arrive via `wireguard-tools`' other
# Recommends. This image dials a real tunnel (`wg-quick up wg0`), and wg-quick
# reaches for `iptables-save` behind a `type -p` guard — so losing it would not
# fail, it would silently skip part of teardown.
RUN apt-get update && apt-get install -y --no-install-recommends \
    dnsutils \
    curl \
    openssl \
    netcat-openbsd \
    iputils-ping \
    iproute2 \
    iptables \
    ca-certificates \
    wireguard-tools \
    wireguard-go \
    && rm -rf /var/lib/apt/lists/*

# A vantage may need to dial a VPN and probe from INSIDE the tunnel — the only
# way to assert VPN reach by real signal rather than by reading a rule string.
# Userspace implementation so the test doesn't depend on the Docker host's kernel.
# NOTE the value: Ubuntu's `wireguard-go` package installs its binary as
# /usr/bin/wireguard, NOT `wireguard-go`. Naming the binary wrong here fails
# only on a host WITHOUT the kernel module — i.e. it passes locally and
# breaks in CI, which is the worst possible way for this to be wrong.
ENV WG_QUICK_USERSPACE_IMPLEMENTATION=wireguard

COPY config/routing/observer-setup.sh /startup.sh
RUN chmod +x /startup.sh

CMD ["/startup.sh"]