Dockerfile.scanner

# RemotePower scanner satellite image — the Security → Pentest scan worker for
# the single-node docker-compose default (see docker-compose.yml's `scanner`
# service). Built FROM the main server image so its www-data UID/GID match
# exactly, letting this container read the token minted by the main
# container's entrypoint.sh into the shared data volume without any
# cross-container UID/permission setup.
#
# Runner: RP_SCAN_RUNNER=nuclei — a single static binary, run directly, NOT
# RP_SCAN_RUNNER=docker/podman. This container is never given the Docker
# socket (mounting docker.sock into any container, even read-only, is
# effectively host root — see CLAUDE.md). That trades tool coverage (no
# nikto/nmap/zap/wapiti, which normally run as sibling containers via the
# socket) for a default that needs no privileged access at all; operators who
# want the full toolchain should point RP_SCAN_RUNNER at docker/podman on a
# separate, dedicated scanner machine per docs/security-scans.md instead.
ARG BASE_IMAGE=ghcr.io/tyxak/remotepower:latest
FROM ${BASE_IMAGE}

# A vulnerability scanner running a stale engine reports clean and means
# nothing, which is the worst failure this image can have: current template
# packs assume a newer engine and their detections are skipped in silence.
ARG NUCLEI_VERSION=3.11.1

USER root
RUN apt-get update -qq && \
    apt-get install -y --no-install-recommends curl ca-certificates unzip && \
    ARCH="$(dpkg --print-architecture)" && \
    case "$ARCH" in amd64) NARCH=amd64 ;; arm64) NARCH=arm64 ;; *) echo "unsupported arch: $ARCH" >&2; exit 1 ;; esac && \
    cd /tmp && \
    curl -fsSL -o "nuclei_${NUCLEI_VERSION}_linux_${NARCH}.zip" \
        "https://github.com/projectdiscovery/nuclei/releases/download/v${NUCLEI_VERSION}/nuclei_${NUCLEI_VERSION}_linux_${NARCH}.zip" && \
    curl -fsSL -o nuclei_checksums.txt \
        "https://github.com/projectdiscovery/nuclei/releases/download/v${NUCLEI_VERSION}/nuclei_${NUCLEI_VERSION}_checksums.txt" && \
    # Verify before unzipping. Everywhere else in this repo a downloaded
    # artifact is checked — the agent one-liner pins a sha256, both PKGBUILDs
    # PGP-verify the tarball — and this one became a root-owned binary in the
    # image on the strength of an HTTPS fetch alone.
    grep " nuclei_${NUCLEI_VERSION}_linux_${NARCH}.zip\$" nuclei_checksums.txt > nuclei.sha256 && \
    sha256sum -c nuclei.sha256 && \
    unzip -q "nuclei_${NUCLEI_VERSION}_linux_${NARCH}.zip" -d /usr/local/bin nuclei && \
    chmod 755 /usr/local/bin/nuclei && \
    rm -f "nuclei_${NUCLEI_VERSION}_linux_${NARCH}.zip" nuclei_checksums.txt nuclei.sha256 && \
    apt-get purge -y curl unzip && apt-get autoremove -y && \
    apt-get clean && rm -rf /var/lib/apt/lists/*

RUN mkdir -p /opt/remotepower
COPY client/remotepower-scanner.py /opt/remotepower/remotepower-scanner.py
COPY docker/scanner-entrypoint.sh  /usr/local/bin/scanner-entrypoint.sh
RUN chmod 755 /opt/remotepower/remotepower-scanner.py /usr/local/bin/scanner-entrypoint.sh

VOLUME ["/var/lib/remotepower"]
USER www-data
ENTRYPOINT ["/usr/local/bin/scanner-entrypoint.sh"]