Dockerfile

# python:slim (Debian) base: paramiko's crypto deps (cryptography, bcrypt, pynacl, cffi)
# all ship manylinux wheels here, so the image builds with no compiler and no musl wheel
# roulette. The recon-era masscan/nmap/libpcap packages are gone -- an SSH pot needs none.
FROM python:3.11-slim

# LOG_API is baked at build; SSH_PORT/EXT_PORT default here and are overridden at deploy
# time by SshHoneypotService. The pot listens on the high, unprivileged in-container port
# SSH_PORT (the compose maps the real cloned port to it), so it never needs NET_BIND_SERVICE
# and the container can drop ALL capabilities.
ARG LOG_API
ARG SSH_PORT=65022
ARG EXT_PORT=22
ENV LOG_API=${LOG_API} \
    SSH_PORT=${SSH_PORT} \
    EXT_PORT=${EXT_PORT} \
    PYTHONUNBUFFERED=1

# Unprivileged service account; the pot writes nothing to disk (logs go to log-api over
# HTTP, the host key is generated in memory) so the root FS can be mounted read-only.
RUN groupadd -g 2000 pro && useradd -u 2000 -g 2000 -M -s /usr/sbin/nologin pro

COPY ./src /home/pro/

# git is only needed to pip-install sofahutils from its repo; purge it afterwards so it is
# not present in the final image. hadolint ignore=DL3013
RUN apt-get update \
    && apt-get install -y --no-install-recommends git \
    && pip install --no-cache-dir \
        paramiko==3.4.0 \
        "git+https://github.com/sofahd/sofahutils.git" \
    && apt-get purge -y git \
    && apt-get autoremove -y \
    && rm -rf /var/lib/apt/lists/* \
    && chown -R pro:pro /home/pro

WORKDIR /home/pro
USER pro:pro

CMD ["python3", "/home/pro/startup.py"]