# VastNFS Prometheus exporter container image.
#
# Build (from repository root):
#   docker build -t vastnfs-exporter:latest \
#     --build-arg VERSION="$(./git-version.sh HEAD)" \
#     -f exporter/Dockerfile exporter
#
# Run (intended container model — root + dropped caps; see exporter-requirements §10):
#   docker run -d --name vastnfs-exporter --network host \
#     --read-only --cap-drop ALL --security-opt no-new-privileges \
#     -v /sys/kernel/debug:/sys/kernel/debug:ro \
#     -v /sys/kernel/sunrpc:/sys/kernel/sunrpc:ro \
#     vastnfs-exporter:latest

FROM python:3-slim-bookworm

LABEL org.opencontainers.image.title="vastnfs-exporter" \
      org.opencontainers.image.description="Prometheus exporter for VastNFS RPC transport statistics"

RUN pip install --no-cache-dir 'prometheus_client>=0.16'

# Account kept for packaging/systemd parity; container runs as root (§10).
RUN groupadd -r vastnfs-exporter \
    && useradd -r -g vastnfs-exporter \
        -d /usr/share/vastnfs-exporter \
        -s /usr/sbin/nologin \
        -c "VastNFS Prometheus exporter" \
        vastnfs-exporter

WORKDIR /usr/share/vastnfs-exporter

COPY exporter.py metrics.py discovery.py ./
COPY vastnfs-exporter /usr/bin/vastnfs-exporter
RUN chmod 0755 /usr/bin/vastnfs-exporter

ARG VERSION=dev
RUN echo "${VERSION}" > /usr/share/vastnfs-exporter/version \
    && chown vastnfs-exporter:vastnfs-exporter /usr/share/vastnfs-exporter/version

USER root

EXPOSE 9001
STOPSIGNAL SIGTERM

ENTRYPOINT ["/usr/bin/vastnfs-exporter"]
CMD []
