FROM python:3.12-slim
RUN apt-get update && apt-get install -y --no-install-recommends nodejs procps iproute2 \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd -g 10001 app && useradd -u 10001 -g app -M app \
    && groupadd -g 10002 auditor && useradd -u 10002 -g auditor -M auditor
WORKDIR /work
COPY . /work
RUN mkdir -p /srv/vault/data /srv/vault/config /srv/vault/logs \
    && printf 'synthetic-only\n' > /srv/vault/data/demo.txt \
    && printf 'MODE=demo\n' > /srv/vault/config/app.conf \
    && chown -R app:app /srv/vault/data /srv/vault/logs \
    && chown root:app /srv/vault/config /srv/vault/config/app.conf \
    && chmod 755 /srv/vault /work \
    && chmod 700 /srv/vault/data /srv/vault/logs \
    && chmod 600 /srv/vault/data/demo.txt \
    && chmod 750 /srv/vault/config && chmod 640 /srv/vault/config/app.conf \
    && rm -f /work/evidence.json /work/identity-evidence.json /work/vault.db \
    && chown app:app /work
USER app:app
CMD ["bash", "inside.sh"]
