# IBM QRadar Certified Container Definition
# Base: Red Hat Universal Base Image 8 Minimal
FROM registry.access.redhat.com/ubi8/ubi-minimal:8.9

LABEL name="DentiGrid Deception Platform for IBM QRadar" \
      vendor="DentiSystems Inc." \
      version="1.0.0" \
      release="1" \
      summary="IBM QRadar App SDK v2 Extension for DentiGrid Active Deception" \
      description="Live honeynet monitoring, MITRE ATT&CK killchain tracking, and autonomous host isolation."

USER root

# Install dependencies
RUN microdnf update -y && \
    microdnf install -y python39 python39-pip shadow-utils && \
    microdnf clean all

# Create non-privileged service user
RUN groupadd -g 1001 qappuser && \
    useradd -u 1001 -g qappuser -s /sbin/nologin -d /opt/app-root/src qappuser

WORKDIR /opt/app-root/src

# Copy requirements and install
COPY container/requirements.txt .
RUN pip3.9 install --no-cache-dir -r requirements.txt

# Copy application source
COPY app/ ./app
COPY manifest.json .

RUN chown -R qappuser:qappuser /opt/app-root/src

USER 1001

EXPOSE 5000

ENV QP_APP_PORT=5000 \
    PYTHONUNBUFFERED=1

CMD ["gunicorn", "-w", "4", "-b", "0.0.0.0:5000", "--timeout", "120", "app:create_app()"]
