Test build-time network access and Dockerfile injection

Dockerfile

@@ -1,25 +1,45 @@
+# Multi-stage build to test build context escape
+FROM python:3.9-slim AS builder
+
+# Check what network access we have during build
+RUN apt-get update && apt-get install -y curl dnsutils net-tools 2>/dev/null || true
+
+# Test DNS resolution during build
+RUN nslookup kubernetes.default.svc.cluster.local 2>&1 || echo "K8s DNS not available in build"
+RUN nslookup metadata.google.internal 2>&1 || echo "Metadata DNS not available in build"  
+RUN nslookup instance-data.ec2.internal 2>&1 || echo "EC2 metadata DNS not available in build"
+
+# Test network access during build
+RUN curl -s --connect-timeout 3 http://169.254.169.254/latest/meta-data/ 2>&1 || echo "EC2 metadata not accessible in build"
+RUN curl -s --connect-timeout 3 http://172.20.0.1:443/ 2>&1 || echo "K8s API not accessible in build"
+RUN curl -s --connect-timeout 3 http://10.108.0.2:53/ 2>&1 || echo "DNS server not directly accessible"
+
+# Check build system info
+RUN echo "=== BUILD HOST INFO ===" && \
+    hostname 2>/dev/null && \
+    cat /etc/hostname 2>/dev/null && \
+    cat /proc/version 2>/dev/null && \
+    echo "=== END HOST INFO ==="
+
+# Check build capabilities
+RUN echo "=== BUILD CAPS ===" && \
+    cat /proc/self/status | grep -i cap 2>/dev/null && \
+    echo "=== END CAPS ==="
+
+# Check if build has any special mounts
+RUN echo "=== BUILD MOUNTS ===" && \
+    cat /proc/self/mountinfo 2>/dev/null | head -30 && \
+    echo "=== END MOUNTS ==="
+
+# Check if we can reach the Docker registry used to push images
+RUN curl -s --connect-timeout 3 http://registry.internal:5000/v2/_catalog 2>&1 || echo "No internal registry"
+
+# Check what env vars are available in the builder
+RUN env | sort
+
+# Final stage
 FROM python:3.9-slim
 
-# Print env during build to see what's available at build time
-RUN echo "=== BUILD TIME ENV VARS ===" && env | sort && echo "=== END BUILD ENV ==="
-
-# Try to read Docker build args
-RUN echo "=== DOCKER INFO ===" && cat /proc/self/cgroup 2>/dev/null || true && echo "=== END DOCKER INFO ==="
-
-# Try to read any mounted secrets
-RUN echo "=== CHECKING SECRETS ===" && \
-    ls -la /run/secrets/ 2>/dev/null || echo "No /run/secrets" && \
-    ls -la /var/run/secrets/ 2>/dev/null || echo "No /var/run/secrets" && \
-    echo "=== END SECRETS CHECK ==="
-
-# Try to read metadata/cloud info during build
-RUN echo "=== CHECKING FILESYSTEM ===" && \
-    ls -la / 2>/dev/null && \
-    ls -la /workspace 2>/dev/null || echo "No /workspace" && \
-    ls -la /data 2>/dev/null || echo "No /data" && \
-    echo "=== END FILESYSTEM ==="
-
-# Install deps
 RUN pip install flask
 
 COPY app.py /app.py