Dockerfile

# ── Build stage ──────────────────────────────────────────────────────────────
# A separate build stage ensures gcc and build tooling never land in the
# final runtime image. All five production dependencies (boto3, botocore,
# rich, click, jinja2) are pure-Python; no compilation is needed.
FROM python:3.13-slim AS builder

# SECURITY NOTE: pin to a specific digest in production and automate
# updates via Dependabot or Renovate so OS-level security patches are
# applied automatically, e.g.:
#   FROM python:3.13-slim@sha256:<digest>

WORKDIR /build

COPY pyproject.toml README.md LICENSE ./
COPY rds_security_scanner/ ./rds_security_scanner/

RUN pip install --no-cache-dir --prefix=/install .

# ── Runtime stage ─────────────────────────────────────────────────────────────
# No compiler, no build tools - minimal attack surface.
FROM python:3.13-slim

LABEL maintainer="Toc Consulting <tarek@tocconsulting.fr>"
LABEL description="AWS RDS security scanner with compliance mapping for CIS, PCI-DSS, HIPAA, SOC 2, ISO, GDPR, and NIST"
LABEL version="1.0.0"

ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1

WORKDIR /app

COPY --from=builder /install /usr/local

# Run as root so the documented credential mount
# (-v ~/.aws:/root/.aws:ro) and env-var credentials both work. A non-root
# user has HOME=/app, so it reads /app/.aws and cannot see a host
# ~/.aws/credentials mounted at /root/.aws (also uid mismatch + 0600
# perms) - that silently broke --profile based runs. This matches the
# ec2/lambda/iam/ecs-eks scanners in the family.
RUN mkdir -p /app/output

ENV RDS_SCANNER_OUTPUT_DIR=/app/output

ENTRYPOINT ["rds-security-scanner"]
CMD ["--help"]