# syntax=docker/dockerfile:1
#
# Runs ipabusedb-docker-reporter as a runit service under the baseimage's
# runsvinit: sleep INTERVAL seconds, report the last INTERVAL seconds of
# sshd brute-force attempts to AbuseIPDB, repeat.
#
# Run with the host's docker socket bind-mounted and the config in the
# container environment:
#
#   docker run -d --restart unless-stopped \
#     -v /var/run/docker.sock:/var/run/docker.sock \
#     -e DOCKER_CONTAINER_NAME=sshd \
#     -e IPABUSEDB_API_KEY=... \
#     -e INTERVAL=1200 \
#     git.eeqj.de/sneak/ipabusedb-docker-reporter:latest

FROM git.eeqj.de/sneak/baseimage:2026-11-05

# The reporter shells out to "docker logs", so it needs the docker CLI.
# The static binary from the official CLI image avoids pulling the whole
# docker.io package (and daemon) in via apt. Pinned to a release tag plus
# the multi-arch manifest list digest.
COPY --from=docker:29.9.3-cli@sha256:2357639ad1ea7d0194134bf3292622fd4e562483966ed674e5d7c945b5f3b28d \
    /usr/local/bin/docker /usr/local/bin/docker

WORKDIR /src
COPY go.mod go.sum ./
RUN --mount=type=cache,target=/root/go/pkg/mod go mod download
COPY *.go ./
RUN --mount=type=cache,target=/root/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    CGO_ENABLED=0 go build -o /usr/local/bin/ipabusedb-docker-reporter .

COPY sv/ipabusedb-docker-reporter/run /etc/sv/ipabusedb-docker-reporter/run
RUN chmod +x /etc/sv/ipabusedb-docker-reporter/run \
    && ln -s /etc/sv/ipabusedb-docker-reporter /etc/service/ipabusedb-docker-reporter

# Seconds to sleep between runs; also the --since window of each run.
ENV INTERVAL=1200

WORKDIR /