# Riposte CLI image. Two stage: build the wheel, then install it into a slim
# runtime and run as a non-root user.
#
# Note on real scans: Riposte drives isolated Docker-Kali sandbox containers, so
# a live scan needs access to a Docker daemon. Either run riposte on a host with
# Docker and mount the socket
#   docker run --rm -v /var/run/docker.sock:/var/run/docker.sock riposte scan ...
# or run the CLI for non-sandbox commands (scope, detections, audit) anywhere.
# Set RIPOSTE_AUDIT_KEY (or RIPOSTE_AUDIT_DEV=1) so the audit log has a key.

FROM python:3.12-slim AS build
WORKDIR /app
COPY pyproject.toml README.md LICENSE ./
COPY src ./src
RUN pip install --no-cache-dir build && python -m build --wheel

FROM python:3.12-slim
LABEL org.opencontainers.image.title="riposte" \
      org.opencontainers.image.description="Continuous AI purple-team platform: every attack it proves, it ships a verified detection." \
      org.opencontainers.image.source="https://github.com/JoakimLarssen/Riposte" \
      org.opencontainers.image.licenses="Apache-2.0"
RUN useradd -m -u 1000 riposte
COPY --from=build /app/dist/*.whl /tmp/
RUN pip install --no-cache-dir /tmp/*.whl && rm -f /tmp/*.whl
USER riposte
WORKDIR /home/riposte
ENTRYPOINT ["riposte"]
CMD ["--help"]
