# Chapter 11 lab environment
# Base: python:3.12-slim (known-good public image)
# Installs: JupyterLab + pandas + openpyxl (for .xlsx export)
#
# We build from python:3.12-slim rather than a community Jupyter image
# because it is a known-stable public image whose size is small and whose
# provenance is unambiguous. The installed tool set is exactly what the
# companion notebook 11_control_matrix.ipynb requires.

FROM python:3.12-slim

LABEL description="Chapter 11 GRC lab environment - JupyterLab with pandas"

# Create a non-root user (jovyan matches Jupyter convention)
RUN useradd -m -s /bin/bash jovyan

# Install build deps, then Python packages, then clean up in one layer
RUN apt-get update && apt-get install -y --no-install-recommends \
        gcc \
    && pip install --no-cache-dir \
        jupyterlab==4.3.6 \
        pandas==2.2.3 \
        openpyxl==3.1.5 \
        matplotlib==3.9.4 \
        tabulate==0.9.0 \
    && apt-get purge -y gcc \
    && apt-get autoremove -y \
    && rm -rf /var/lib/apt/lists/*

# Working dirs
RUN mkdir -p /home/jovyan/work /home/jovyan/seed \
    && chown -R jovyan:jovyan /home/jovyan

USER jovyan
WORKDIR /home/jovyan/work

EXPOSE 8888

CMD ["jupyter", "lab", \
     "--ip=0.0.0.0", \
     "--port=8888", \
     "--no-browser", \
     "--NotebookApp.token=ch11-grc-lab", \
     "--NotebookApp.notebook_dir=/home/jovyan/work"]
