# Base image pinned by digest (multi-arch manifest list), verified against
# registry-1.docker.io 2026-11-14. A tag alone can be re-pointed; the digest
# cannot. To update the base image, fetch the new digest from Docker Hub
# and update this line (and the SBOM note in build-zip.py).
FROM python:3.12.14-slim@sha256:f77ac9e44ae96ef2c90b8053ea08c31f8be030f824196b0ae4db6d462c84e51f
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
WORKDIR /scanner
RUN groupadd --gid 10001 scanner && useradd --uid 10001 --gid 10001 --no-create-home scanner
COPY --chown=10001:10001 app ./app
USER 10001:10001
ENTRYPOINT ["python", "-m", "app"]
