# CKS exam host: the common exam host (images/node) plus what the CKS hosts carry - the scanners,
# a sandbox runtime and a service mesh client. Built by `./ksim build cks`.
ARG BASE
FROM ${BASE}
RUN apt-get update \
 && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
      python3-minimal binutils strace file bzip2 conntrack tcpdump lsof kmod vsftpd \
 && rm -rf /var/lib/apt/lists/* \
 # vsftpd is here to be found and removed in a task; it must not run on every host
 && (systemctl disable vsftpd >/dev/null 2>&1 || true) \
 && rm -f /etc/systemd/system/multi-user.target.wants/vsftpd.service

# --- CKS tools --------------------------------------------------------------------------------
ARG KUBE_BENCH=0.16.0
ARG TRIVY=0.75.0
ARG KUBESEC=2.15.0
ARG KUBE_LINTER=0.8.3
ARG BOM=0.8.0
ARG COSIGN=3.1.3
ARG ISTIO=1.31.1
ARG GVISOR=20261005
RUN cd /tmp && G=https://github.com \
 && curl -fsSL "$G/aquasecurity/kube-bench/releases/download/v${KUBE_BENCH}/kube-bench_${KUBE_BENCH}_linux_amd64.tar.gz" | tar -xz kube-bench cfg \
 && install -m755 kube-bench /usr/local/bin/ && mkdir -p /etc/kube-bench && rm -rf /etc/kube-bench/cfg && mv cfg /etc/kube-bench/cfg && rm -f kube-bench \
 && curl -fsSL "$G/aquasecurity/trivy/releases/download/v${TRIVY}/trivy_${TRIVY}_Linux-64bit.tar.gz" | tar -xz -C /usr/local/bin trivy \
 && curl -fsSL "$G/controlplaneio/kubesec/releases/download/v${KUBESEC}/kubesec_linux_amd64.tar.gz" | tar -xz -C /usr/local/bin kubesec \
 && curl -fsSL "$G/stackrox/kube-linter/releases/download/v${KUBE_LINTER}/kube-linter-linux.tar.gz" | tar -xz -C /usr/local/bin kube-linter \
 && curl -fsSL -o /usr/local/bin/bom "$G/kubernetes-sigs/bom/releases/download/v${BOM}/bom-amd64-linux" \
 && curl -fsSL -o /usr/local/bin/cosign "$G/sigstore/cosign/releases/download/v${COSIGN}/cosign-linux-amd64" \
 && curl -fsSL "$G/istio/istio/releases/download/${ISTIO}/istioctl-${ISTIO}-linux-amd64.tar.gz" | tar -xz -C /usr/local/bin istioctl \
 && curl -fsSL "https://storage.googleapis.com/gvisor/releases/release/${GVISOR}/x86_64/gvisor.tar.bz2" | tar -xj -C /usr/local/bin \
 && chmod 755 /usr/local/bin/* \
 && chown -R root:root /usr/local/bin /etc/kube-bench

COPY rootfs/ /
# gVisor as a second runtime handler ("runsc") beside runc; a RuntimeClass selects it
RUN printf '\n[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runsc]\n  runtime_type = "io.containerd.runsc.v1"\n  [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runsc.options]\n    TypeUrl = "io.containerd.runsc.v1.options"\n    ConfigPath = "/etc/containerd/runsc.toml"\n' >> /etc/containerd/config.toml \
 # trivy reads /etc/trivy.yaml (the Docker Hub cache as a mirror, one cache directory for all
 # users), for logins and for sudo alike
 && install -d -m 1777 /var/lib/trivy \
 && echo 'TRIVY_CONFIG=/etc/trivy.yaml' >> /etc/environment \
 && echo 'export TRIVY_CONFIG=/etc/trivy.yaml' >> /etc/exam.bashrc