# SOCKS5 proxy that bridges the host into a per-test simulated network.
#
# Used by NetworkHandle.socksProxy()/browser() so a host browser (manual
# or Playwright-driven) can reach the deployed app exactly as a user
# inside the simulation would. The container needs more than just a
# SOCKS daemon — depending on the vantage it joins, it has to:
#   - replace docker's IPAM-default gateway (which has no listener)
#     with the simulated zone's actual router
#   - bypass docker's embedded DNS resolver and talk to the in-network
#     resolver directly, so DNS responses reflect the simulated
#     internet (split-horizon, namecheap publication, etc.)
# The startup script handles both based on the VANTAGE env var passed
# at `docker run` time.
FROM ubuntu:22.04@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02

RUN apt-get update && apt-get install -y \
    dante-server \
    iproute2 \
    iputils-ping \
    dnsutils \
    && rm -rf /var/lib/apt/lists/*

COPY config/socks/danted.conf /etc/danted.conf
COPY config/socks/startup.sh /startup.sh
RUN chmod +x /startup.sh

EXPOSE 1080
CMD ["/startup.sh"]