# BAD: Full Debian/Ubuntu - hundreds of packages, many CVEs
FROM ubuntu:22.04

# BETTER: Debian Slim - reduced package set
FROM debian:12-slim

# BETTER: Alpine Linux - ~5MB, musl libc, minimal attack surface
FROM alpine:3.19

# BEST for Go/Rust: Distroless - no shell, no package manager
FROM gcr.io/distroless/static-debian12

# BEST for Java: Distroless Java
FROM gcr.io/distroless/java17-debian12

# BEST for compiled binaries: scratch (empty, zero-byte base)
FROM scratch

# Build stage - has all build tools
FROM golang:1.22-alpine AS builder

WORKDIR /build

# Copy dependency files first (better layer caching)
COPY go.mod go.sum ./
RUN go mod download

# Copy source and build
COPY . .
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
    go build -ldflags="-w -s" -o /app/server ./cmd/server

# Final stage - minimal runtime image
FROM gcr.io/distroless/static-debian12

# Copy only the compiled binary
COPY --from=builder /app/server /server

EXPOSE 8080
ENTRYPOINT ["/server"]

# Dependencies stage
FROM node:20-alpine AS deps
WORKDIR /app
COPY package.json yarn.lock ./
RUN yarn install --frozen-lockfile --production

# Build stage
FROM node:20-alpine AS build
WORKDIR /app
COPY package.json yarn.lock ./
RUN yarn install --frozen-lockfile
COPY . .
RUN yarn build

# Production stage
FROM node:20-alpine AS production
WORKDIR /app

# Copy only production dependencies and build output
COPY --from=deps /app/node_modules ./node_modules
COPY --from=build /app/dist ./dist

# Remove yarn cache and unnecessary files
RUN rm -rf /tmp/* && \
    find /app/node_modules -name "*.md" -delete && \
    find /app/node_modules -name "*.ts" -delete

EXPOSE 3000
CMD ["node", "dist/index.js"]

# Build stage
FROM python:3.12-slim AS builder

WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir --prefix=/install -r requirements.txt

# Final stage
FROM gcr.io/distroless/python3-debian12

COPY --from=builder /install /usr/local
COPY --from=builder /app /app
COPY src/ /app/src/

WORKDIR /app
CMD ["src/main.py"]

FROM alpine:3.19

# Create a non-root user and group
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

WORKDIR /app

# Copy files with correct ownership
COPY --chown=appuser:appgroup . .

# Install dependencies as root, then switch
RUN apk add --no-cache ca-certificates && \
    chown -R appuser:appgroup /app

# Switch to non-root user for the rest
USER appuser

EXPOSE 8080
CMD ["/app/server"]

FROM gcr.io/distroless/static-debian12:nonroot

COPY --chown=nonroot:nonroot ./server /server
USER nonroot

ENTRYPOINT ["/server"]

# Check what user the container runs as
docker run --rm myapp:latest id
# Expected: uid=65532(nonroot) gid=65532(nonroot)

# Run-time override to force non-root
docker run --user 1000:1000 myapp:latest

FROM alpine:3.19

RUN adduser -S -D -H -u 1001 appuser

COPY ./server /usr/local/bin/server

USER 1001

# Use /tmp for temporary files (writable even with read-only root FS)
VOLUME ["/tmp"]

EXPOSE 8080
CMD ["/usr/local/bin/server"]

docker run \
  --read-only \                              # Read-only root filesystem
  --tmpfs /tmp:rw,noexec,nosuid,size=64m \  # Writable /tmp in memory
  --cap-drop ALL \                           # Drop all Linux capabilities
  --cap-add NET_BIND_SERVICE \               # Add only what's needed
  --security-opt no-new-privileges=true \    # No privilege escalation
  --security-opt seccomp=/etc/docker/seccomp/default.json \
  --user 1001:1001 \
  myapp:latest

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
spec:
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
        runAsGroup: 1001
        fsGroup: 1001
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: myapp
        image: myapp:latest
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop: ["ALL"]
            add: ["NET_BIND_SERVICE"]
        volumeMounts:
        - name: tmp-dir
          mountPath: /tmp
      volumes:
      - name: tmp-dir
        emptyDir: {}

# BAD: Creates multiple layers, apt cache remains in image
RUN apt-get update
RUN apt-get install -y curl wget
RUN rm -rf /var/lib/apt/lists/*

# GOOD: Single layer, cache cleaned in same RUN
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        curl \
        ca-certificates && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

# Alpine: Even smaller installs
RUN apk add --no-cache curl ca-certificates

# Remove tools after use in the same RUN
RUN apk add --no-cache --virtual .build-deps \
        gcc \
        musl-dev && \
    pip install --no-cache-dir -r requirements.txt && \
    apk del .build-deps   # Remove build tools after compilation

cat > .dockerignore << 'EOF'
.git
.gitignore
.github
*.md
docs/
tests/
Makefile
.env
.env.local
*.log
node_modules/
__pycache__/
*.pyc
.coverage
.pytest_cache/
.DS_Store
EOF

# BAD: Secret stored in image layer
FROM alpine
RUN curl -H "Authorization: Bearer mysecret" https://api.example.com/setup

# GOOD: Use BuildKit secret (never stored in image)
# syntax=docker/dockerfile:1
FROM alpine

RUN --mount=type=secret,id=api_token \
    curl -H "Authorization: Bearer $(cat /run/secrets/api_token)" \
    https://api.example.com/setup

# Build with BuildKit secret
docker buildx build \
  --secret id=api_token,src=./secrets/api_token.txt \
  -t myapp:latest .

# NEVER use --build-arg for secrets (stored in image history)
# docker build --build-arg DB_PASSWORD=secret .  # BAD

# GOOD: Pass secrets at runtime only
docker run -e DB_PASSWORD="$(vault kv get -field=password secret/db)" myapp:latest

# GOOD: Mount secrets file at runtime
docker run -v /run/secrets/db-password:/run/secrets/db-password:ro myapp:latest

# Trivy secret scan
trivy image --scanners secret myapp:latest

# Check git history for secrets
git log --all --full-history -- '*.env'

# Makefile targets for secure builds
cat > Makefile << 'EOF'
IMAGE_NAME = myapp
IMAGE_TAG  = $(shell git rev-parse --short HEAD)

.PHONY: build scan push

build:
	docker buildx build --platform linux/amd64,linux/arm64 \
	  -t $(IMAGE_NAME):$(IMAGE_TAG) \
	  -t $(IMAGE_NAME):latest \
	  --load .

scan: build
	# Fail if any HIGH or CRITICAL CVEs found
	trivy image --exit-code 1 --severity HIGH,CRITICAL \
	  --ignore-unfixed $(IMAGE_NAME):$(IMAGE_TAG)

push: scan
	docker push $(IMAGE_NAME):$(IMAGE_TAG)
	docker push $(IMAGE_NAME):latest
EOF

# Check what libraries your binary needs
ldd ./server

# For Alpine builds, ensure the binary is statically compiled
# For Go:
CGO_ENABLED=0 go build -o server .

# Use the debug variant for troubleshooting (includes busybox shell)
FROM gcr.io/distroless/static-debian12:debug
# Then: docker run --rm --entrypoint=sh myapp:latest

# Add specific writable directories as tmpfs or emptyDir volumes
# Don't disable read-only just to fix permission issues

# Find what directories the app writes to:
strace -e trace=openat,write -p $(pgrep myapp) 2>&1 | grep O_WRONLY

# Check file permissions in the Dockerfile
RUN chown -R appuser:appgroup /app && \
    chmod -R 755 /app

# Or use --chown with COPY
COPY --chown=appuser:appgroup ./app /app