FROM python:3.12-slim

LABEL org.opencontainers.image.title="ch03-tools" \
      org.opencontainers.image.description="Security tool-runner for Chapter 3 labs (Bandit, Semgrep, pip-audit, sqlmap, PyJWT)"

RUN apt-get update -qq && apt-get install -y --no-install-recommends \
    curl git wget nmap iputils-ping netcat-openbsd \
    && rm -rf /var/lib/apt/lists/*

RUN pip install --no-cache-dir \
    bandit==1.9.4 \
    semgrep \
    pip-audit==2.10.0 \
    sqlmap \
    pyjwt==2.10.1 \
    cryptography==44.0.3 \
    requests \
    pydantic==2.13.4

# Copy the vulnerable app source so SAST tools can scan it
COPY app/ /target/

WORKDIR /target

CMD ["bash"]
