# Detection Watch for Wazuh 4.x: read-only, non-root, stdlib + cryptography only.
FROM python:3.12-slim

RUN pip install --no-cache-dir cryptography==46.0.7 \
 && useradd --system --uid 10001 --user-group --no-create-home dw \
 && mkdir -p /var/detection-watch/out /samples /wazuh/logs /wazuh/etc/rules /wazuh/ruleset/rules \
 && chown -R dw:dw /var/detection-watch

WORKDIR /app
COPY dw/ /app/dw/
COPY config.example.json /app/config.json

ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1
USER dw

# Runs scan + replay (compare mode) every 24 h at 02:00 container-local time (set TZ).
ENTRYPOINT ["python3", "-m", "dw"]
CMD ["all", "--compare", "--every", "24h", "--at", "02:00"]
