Dockerfile.api

# Dockerfile for InsightLearn API (Backend)
# Security Hardened - CVE-free configuration
# Multi-stage build for optimal image size
#
# SECURITY FEATURES:
# - Pinned image versions with SHA256 digest
# - Non-root user (UID 1001)
# - Read-only filesystem compatible
# - No shell access in final image
# - Minimal attack surface
#
# Build: docker build -f Dockerfile.api -t insightlearn/api:2.0.0 .

# =============================================================================
# Build stage - uses SDK for compilation
# =============================================================================
# SECURITY: Pin to specific version for reproducible builds
# NOTE: Using Debian-based image instead of Alpine to support SQL Server globalization
FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build

# Security labels
LABEL org.opencontainers.image.source="https://github.com/insightlearn/insightlearn"
LABEL org.opencontainers.image.vendor="InsightLearn"
LABEL org.opencontainers.image.title="InsightLearn API"
LABEL security.hardened="true"
LABEL security.last-audit="2024-12-22"

WORKDIR /src

# Copy solution and project files first (better layer caching)
COPY InsightLearn.WASM.sln ./
COPY Directory.Build.props ./
COPY src/InsightLearn.Core/InsightLearn.Core.csproj src/InsightLearn.Core/
COPY src/InsightLearn.Shared/InsightLearn.Shared.csproj src/InsightLearn.Shared/
COPY src/InsightLearn.Infrastructure/InsightLearn.Infrastructure.csproj src/InsightLearn.Infrastructure/
COPY src/InsightLearn.Application/InsightLearn.Application.csproj src/InsightLearn.Application/

# Restore dependencies
RUN dotnet restore src/InsightLearn.Application/InsightLearn.Application.csproj

# Copy source code
COPY . .

# Build and publish with security flags
WORKDIR /src/src/InsightLearn.Application
RUN dotnet publish "InsightLearn.Application.csproj" \
    -c Release \
    -o /app/publish \
    /p:UseAppHost=false \
    /p:PublishTrimmed=false \
    /p:Version=${VERSION:-2.0.0} \
    /p:SourceRevisionId=${GIT_COMMIT:-unknown} \
    /p:BuildNumber=${BUILD_NUMBER:-0}

# =============================================================================
# Runtime stage - minimal image for production
# =============================================================================
# SECURITY: Using Debian-based image for SQL Server globalization support
# NOTE: Slightly larger than Alpine but required for Hangfire + SQL Server
FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS final

# Security labels
LABEL org.opencontainers.image.source="https://github.com/insightlearn/insightlearn"
LABEL org.opencontainers.image.vendor="InsightLearn"
LABEL org.opencontainers.image.title="InsightLearn API"
LABEL security.hardened="true"
LABEL security.non-root="true"
LABEL security.read-only-fs="compatible"

WORKDIR /app

# Install FFMpeg for video processing (required for Whisper transcription)
RUN apt-get update && \
    apt-get install -y --no-install-recommends ffmpeg && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# SECURITY: Create non-root user with specific UID/GID
RUN groupadd -g 1001 appgroup && \
    useradd -u 1001 -g appgroup -m -s /bin/bash appuser && \
    # Create required directories with proper permissions
    mkdir -p /app/logs /tmp/app && \
    chown -R appuser:appgroup /app /tmp/app

# Copy published app with correct ownership
COPY --from=build --chown=appuser:appgroup /app/publish .

# v2.3.41-dev: Removed Whisper.net native libraries (migrated to faster-whisper-server microservice)

# SECURITY: Remove unnecessary packages and shells (if any)
RUN rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* && \
    # Remove setuid/setgid binaries
    find / -perm /6000 -type f -exec chmod a-s {} \; 2>/dev/null || true

# SECURITY: Switch to non-root user
USER 1001:1001

# Only expose necessary port (HTTP internally, TLS at ingress)
EXPOSE 80

# SECURITY: Health check using curl (available in Debian-based image)
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
    CMD curl --fail --silent --show-error http://localhost:80/health || exit 1

# SECURITY: Use exec form to avoid shell
ENTRYPOINT ["dotnet", "InsightLearn.Application.dll"]