# ── Base: Kali Linux Rolling ────────────────────────────────────────────────
FROM kalilinux/kali-rolling

ENV DEBIAN_FRONTEND=noninteractive
ENV DEBCONF_NONINTERACTIVE_SEEN=true
ENV DEBCONF_NOWARNINGS=yes
ENV APT_LISTCHANGES_FRONTEND=none
ENV OLLAMA_HOST=0.0.0.0:11434
ENV OLLAMA_MODELS=/home/user/.ollama/models
ENV OLLAMA_PORT=11434
ENV API_PORT=7860
ENV PYTHONUNBUFFERED=1
ENV DEFAULT_MODEL=hydra-ai

# ── Preconfigure debconf to never prompt ────────────────────────────────────
RUN echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections \
    && echo 'debconf debconf/priority select critical' | debconf-set-selections

# ── Full Kali default toolset ────────────────────────────────────────────────
# --force-yes was removed in apt 1.x — use --allow-unauthenticated instead
# -y + -o Dpkg flags handle all prompts silently
RUN apt-get update -qq \
    && apt-get install -y \
        --allow-unauthenticated \
        --no-install-recommends \
        -o Dpkg::Options::="--force-confdef" \
        -o Dpkg::Options::="--force-confold" \
        kali-linux-headless \
        curl wget bash procps sudo zstd \
        python3 python3-pip \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

# ── Install Ollama ────────────────────────────────────────────────────────────
RUN curl -fsSL https://ollama.com/install.sh | sh

# ── HF Spaces: non-root user UID 1000 ────────────────────────────────────────
RUN useradd -m -u 1000 user \
    && echo "user ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers \
    && mkdir -p /home/user/.ollama/models \
    && chown -R user:user /home/user

# ── Python deps ───────────────────────────────────────────────────────────────
COPY requirements.txt /app/requirements.txt
RUN pip3 install --break-system-packages --ignore-installed --no-warn-script-location -r /app/requirements.txt
# ── App files ─────────────────────────────────────────────────────────────────
COPY app.py      /app/app.py
COPY web_ui.html /app/web_ui.html
COPY start.sh    /app/start.sh
RUN chmod +x /app/start.sh \
    && chown -R user:user /app

USER user
WORKDIR /app
EXPOSE 7860
CMD ["/app/start.sh"]