Dockerfile

# Multi-stage Dockerfile for cve-cli
# Stage 1: Build stage
FROM ubuntu:22.04 AS builder

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    cmake \
    git \
    pkg-config \
    libcurl4-openssl-dev \
    libssl-dev \
    libsqlite3-dev \
    libncurses-dev \
    libmaxminddb-dev \
    nlohmann-json3-dev \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /src
COPY . .

RUN cmake -B build -DCMAKE_BUILD_TYPE=Release \
    && cmake --build build -j$(nproc)

# Stage 2: Final minimal runtime image
FROM debian:bookworm-slim AS runner

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    curl \
    libcurl4 \
    libssl3 \
    libsqlite3-0 \
    libncurses6 \
    libtinfo6 \
    libmaxminddb0 \
    bind9-host \
    whois \
    unzip \
    && rm -rf /var/lib/apt/lists/*

# Install ProjectDiscovery Nuclei for active vulnerability scanning
RUN ARCH=$(uname -m) && \
    if [ "$ARCH" = "x86_64" ]; then NUCLEI_ARCH="amd64"; \
    elif [ "$ARCH" = "aarch64" ]; then NUCLEI_ARCH="arm64"; \
    else NUCLEI_ARCH="amd64"; fi && \
    curl -sL "https://github.com/projectdiscovery/nuclei/releases/download/v3.3.0/nuclei_3.3.0_linux_${NUCLEI_ARCH}.zip" -o nuclei.zip && \
    unzip nuclei.zip nuclei && \
    mv nuclei /usr/local/bin/nuclei && \
    chmod +x /usr/local/bin/nuclei && \
    rm -f nuclei.zip

WORKDIR /app

# Copy compiled binaries from builder
COPY --from=builder /src/build/cve /usr/local/bin/cve
COPY --from=builder /src/build/cve-tui /usr/local/bin/cve-tui
COPY --from=builder /src/build/cve-server /usr/local/bin/cve-server
COPY --from=builder /src/build/cve-worker /usr/local/bin/cve-worker

# Setup default directories
RUN mkdir -p /app/data /app/reports

VOLUME ["/app/data", "/app/reports"]

ENV CVE_DB_PATH=/app/data/cve.db
ENV PATH="/usr/local/bin:${PATH}"

ENTRYPOINT ["cve"]
CMD ["--help"]