FROM amazon/aws-lambda-python:3.12.2025.11.23.13-x86_64

ARG CACHE_BUSTER=0

# STEP 1: OS Security Patching (Addresses libxml2 CVEs)
# The specific tag and CACHE_BUSTER force the use of the newest patched base image version and apply any fresh patches.
RUN echo "Running security update for build $CACHE_BUSTER" && \
    dnf update -y && \
    dnf clean all

# STEP 2: Install Build Dependencies (for C libraries like confluent-kafka)
# This uses the original file's fallback logic for librdkafka-devel installation.
RUN dnf install -y gcc python3-devel zlib-devel librdkafka-devel || \
    dnf install -y gcc python3-devel zlib-devel

COPY requirements.txt requirements-test.txt ./
# STEP 3: Python Dependencies (Fixes pip CVE-2025-8869)
# Pins pip to 25.2 to resolve the symlink attack vulnerability.
RUN pip install --upgrade pip==25.2 && \
    pip install --only-binary :all: confluent-kafka && \
    pip install -r requirements-test.txt --no-cache-dir

COPY config.py lint-and-test.sh docker-compose.yaml .flake8 ./
COPY src/ ./src
COPY tests/ ./tests

ENTRYPOINT [ "/var/task/lint-and-test.sh" ]