# Vaultace CLI Docker Image
FROM node:18-alpine

# Set metadata
LABEL maintainer="Vaultace Security <hello@vaultace.co>"
LABEL description="AI-powered security scanner that detects vulnerabilities in AI-generated code. Proactive scanning, autonomous fixing, and emergency response for modern development teams."
LABEL org.opencontainers.image.source="https://github.com/vaultace/vaultace-cli"
LABEL org.opencontainers.image.vendor="Vaultace Security"
LABEL org.opencontainers.image.title="Vaultace CLI"
LABEL org.opencontainers.image.description="AI-powered security scanner for detecting vulnerabilities in AI-generated code"
LABEL org.opencontainers.image.url="https://vaultace.co"
LABEL org.opencontainers.image.documentation="https://docs.vaultace.co/cli"
LABEL org.opencontainers.image.licenses="MIT"
LABEL org.opencontainers.image.authors="Vaultace Security <hello@vaultace.co>"
LABEL org.opencontainers.image.category="security"
LABEL org.opencontainers.image.keywords="security,vulnerability-scanner,ai-security,cli,developer-tools,cybersecurity,devsecops"

# Install system dependencies
RUN apk add --no-cache \
    git \
    openssh-client \
    curl \
    bash \
    && rm -rf /var/cache/apk/*

# Create non-root user
RUN addgroup -S vaultace && adduser -S vaultace -G vaultace

# Set working directory
WORKDIR /app

# Copy package files
COPY package*.json ./

# Install dependencies
RUN npm ci --only=production && npm cache clean --force

# Copy application code
COPY --chown=vaultace:vaultace . .

# Create CLI symlink globally
RUN npm link

# Create configuration directory
RUN mkdir -p /root/.vaultace && chown -R vaultace:vaultace /root/.vaultace

# Set permissions
RUN chmod +x src/index.js

# Create entrypoint script before switching users
RUN echo '#!/bin/bash\n\
# Vaultace CLI Docker Entrypoint\n\
set -e\n\
\n\
# If no command provided, show help\n\
if [ $# -eq 0 ]; then\n\
    exec vaultace --help\n\
fi\n\
\n\
# Execute vaultace command\n\
exec vaultace "$@"' > /entrypoint.sh && \
    chmod +x /entrypoint.sh

# Switch to non-root user
USER vaultace

# Set entrypoint
ENTRYPOINT ["/entrypoint.sh"]

# Default command
CMD ["--help"]

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD vaultace --version || exit 1

# Volume for configuration persistence
VOLUME ["/root/.vaultace"]

# Expose no ports (CLI tool)
EXPOSE 0