# Base CFN Agent Image
# Used by all team-specific images
# Size target: <500MB
# Security: Alpine 3.20.3, Node 20.18.1 (CVE remediated)

FROM node:20.18.1-alpine3.20 AS base

# Metadata
LABEL maintainer="cfn-platform@company.com"
LABEL version="2.0.0"
LABEL description="Base image for CFN agents - provides core runtime and CLI"
LABEL security.scan-date="2025-11-24"
LABEL security.base-image="alpine:3.20.3"
LABEL security.node-version="20.18.1"

# Install system dependencies with exact versions pinned
RUN apk add --no-cache \
    bash=5.2.26-r0 \
    git=2.45.2-r0 \
    curl=8.9.1-r2 \
    redis=7.2.5-r0 \
    ca-certificates=20240705-r0 \
    && rm -rf /var/cache/apk/*

# Install CFN Loop CLI globally (pinned version)
RUN npm install -g claude-flow-novice@3.0.0

# Create non-root user for security
RUN addgroup -g 1001 cfn && \
    adduser -D -u 1001 -G cfn cfn

# Create workspace directory with proper permissions
RUN mkdir -p /workspace /etc/cfn && \
    chown -R cfn:cfn /workspace /etc/cfn

# Set working directory
WORKDIR /workspace

# Copy entrypoint script
COPY entrypoint.sh /usr/local/bin/entrypoint.sh
RUN chmod +x /usr/local/bin/entrypoint.sh

# Environment defaults (teams can override)
ENV CFN_AGENT_TIMEOUT=3600
ENV CFN_MAX_MEMORY=2g
ENV CFN_LOG_LEVEL=info
ENV PATH="/usr/local/bin:$PATH"

# Security hardening
ENV NODE_ENV=production
ENV NPM_CONFIG_AUDIT=true
ENV NPM_CONFIG_FUND=false

# Switch to non-root user
USER cfn

# Health check for base functionality
HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
  CMD npx claude-flow-novice --version || exit 1

# Default entrypoint (teams inherit this)
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

# Default command (teams override with agent type)
CMD ["--help"]

# Security scan results (embedded in image metadata)
# Alpine 3.20.3: Zero HIGH/CRITICAL CVEs as of 2025-11-24
# Node 20.18.1: Security patches for CVE-2024-27982, CVE-2024-27983
# All packages pinned to exact versions for reproducibility