Dockerfile.nmap

# PiHerder nmap worker image — same app code + nmap binary.
# Does NOT bake Vulners / CVE databases into layers; mount PIHERDER_NMAP_VULN_ROOT.
#
#   docker build -f Dockerfile.nmap -t piherder:nmap-local .
#   docker compose --profile nmap up -d celery-worker-nmap
#
FROM python:3.12-slim-bookworm

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PIHERDER_NMAP_VULN_ROOT=/var/lib/piherder/nmap-vuln \
    PIHERDER_NMAP_WORKER=1

RUN apt-get update && apt-get install -y --no-install-recommends \
    nmap \
    ca-certificates \
    curl \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY requirements.lock.txt ./
RUN pip install --upgrade pip setuptools wheel && \
    pip install --require-hashes -r requirements.lock.txt

COPY . .
RUN pip install --no-deps -e .

# nmap worker does not need Tailwind/CDN assets; skip vendor step for smaller/faster builds.

RUN mkdir -p /data /var/lib/piherder/nmap-vuln

# Run as root: stock nmap requires euid 0 for SYN (-sS), UDP, and OS detect.
# This image is opt-in (compose profile ``nmap``) and only consumes queue ``nmap``.
# Without root, PiHerder still works — scan code falls back to TCP connect (-sT).
USER root

# Default: Celery consumer for the nmap queue only (concurrency 1 — scans are heavy).
CMD ["celery", "-A", "app.celery_app.celery", "worker", \
     "--loglevel=info", "-Q", "nmap", "--concurrency=1", "-n", "nmap@%h"]