Dockerfile.dev

# Rails 8 Enterprise Development Dockerfile - SECURITY HARDENED
# Updated to latest secure base image with vulnerability fixes

FROM ruby:3.4.4-slim-bookworm

# Set up environment
ENV RAILS_ENV=development
ENV BUNDLE_PATH=/usr/local/bundle
ENV BUNDLE_BIN=/usr/local/bundle/bin
ENV PATH=$BUNDLE_BIN:$PATH

# Install system dependencies with security updates
RUN apt-get update -qq && \
    apt-get upgrade -y && \
    apt-get install -y --no-install-recommends \
        # Essential build tools
        build-essential \
        git \
        curl \
        wget \
        # PostgreSQL client and development headers
        postgresql-client \
        libpq-dev \
        # SQLite for SolidQueue
        libsqlite3-dev \
        sqlite3 \
        pkg-config \
        # YAML library for psych gem
        libyaml-dev \
        # Python for communication with Haystack service
        python3 \
        python3-pip \
        # Additional utilities
        vim \
        less \
        # Health check utilities
        netcat-openbsd \
        # Security essentials
        ca-certificates \
        && \
    # Clean up to reduce attack surface
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# Set working directory
WORKDIR /rails

# Copy dependency files first for better caching
COPY Gemfile ./

# Install Ruby gems with security focus
# Generate fresh Gemfile.lock for Linux platforms with sqlite3 2.0 support
RUN bundle config set --local deployment 'false' && \
    bundle config set --local cache_all 'true' && \
    bundle lock --add-platform aarch64-linux x86_64-linux && \
    bundle install --jobs 4 --retry 3

# CRITICAL SECURITY FIXES - Update vulnerable gems
# CVE-2025-27221: URI gem userinfo leakage - Update to >=0.11.3, 0.12.4, 0.13.2, or 1.0.3
# CVE-2025-27219: CGI gem vulnerabilities - Update to >=0.3.5.1, 0.3.7, or 0.4.2
RUN gem update uri cgi --no-document && \
    gem cleanup && \
    # Verify critical gems are updated
    ruby -e "puts 'URI gem version: ' + Gem.loaded_specs['uri']&.version.to_s" && \
    ruby -e "puts 'CGI gem version: ' + Gem.loaded_specs['cgi']&.version.to_s"

# Copy application code
COPY . .

# Create necessary directories for development
RUN mkdir -p tmp/pids tmp/cache tmp/sockets log storage && \
    chmod -R 755 tmp log storage

# Create non-root user for security
RUN groupadd -r rails && useradd -r -g rails rails && \
    chown -R rails:rails /rails

# Create secure entrypoint script for development
RUN echo '#!/bin/bash\n\
# Enterprise development entrypoint script - Security Enhanced\n\
set -e\n\
\n\
# Security check: Verify gem versions\n\
echo "🔒 Security Status:"\n\
ruby -e "puts \"URI gem: #{Gem.loaded_specs[\"uri\"]&.version}\"" || echo "URI gem not loaded"\n\
ruby -e "puts \"CGI gem: #{Gem.loaded_specs[\"cgi\"]&.version}\"" || echo "CGI gem not loaded"\n\
\n\
# Remove any existing server PID file\n\
rm -f /rails/tmp/pids/server.pid\n\
\n\
# Wait for database to be ready\n\
echo "🔍 Waiting for PostgreSQL to be ready..."\n\
until pg_isready -h postgres -p 5432 -U postgres; do\n\
  echo "⏳ Database not ready, waiting 2 seconds..."\n\
  sleep 2\n\
done\n\
echo "✅ PostgreSQL is ready!"\n\
\n\
# Wait for Redis to be ready\n\
echo "🔍 Waiting for Redis to be ready..."\n\
until nc -z redis 6379; do\n\
  echo "⏳ Redis not ready, waiting 2 seconds..."\n\
  sleep 2\n\
done\n\
echo "✅ Redis is ready!"\n\
\n\
# Run database setup if needed\n\
echo "🗄️ Setting up database..."\n\
bundle exec rails db:prepare || bundle exec rails db:create db:migrate\n\
\n\
# Precompile assets for faster page loads\n\
echo "🎨 Preparing assets..."\n\
bundle exec rails assets:precompile\n\
\n\
echo "🚀 Starting Knowverse Enterprise Demo (Security Hardened)..."\n\
# Execute the main command\n\
exec "$@"' > /usr/local/bin/docker-entrypoint && \
    chmod +x /usr/local/bin/docker-entrypoint

# Security-enhanced health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
    CMD curl -f http://localhost:3000/health || exit 1

# Switch to non-root user for security
USER rails

# Expose Rails development server port
EXPOSE 3000

# Set the entrypoint
ENTRYPOINT ["docker-entrypoint"]

# Default command: start Rails development server
CMD ["bundle", "exec", "rails", "server", "-b", "0.0.0.0", "-p", "3000"]