Dockerfile

# Multi-stage Docker build for NetFlow

# Stage 1: Builder
FROM rust:1.75 as builder

# Install dependencies
RUN apt-get update && apt-get install -y \
    libpcap-dev \
    pkg-config \
    && rm -rf /var/lib/apt/lists/*

# Create app directory
WORKDIR /app

# Copy manifests
COPY Cargo.toml Cargo.lock ./

# Copy source
COPY src ./src

# Build release binary
RUN cargo build --release

# Stage 2: Runtime
FROM debian:bookworm-slim

# Install runtime dependencies
RUN apt-get update && apt-get install -y \
    libpcap0.8 \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Copy binary from builder
COPY --from=builder /app/target/release/netflow /usr/local/bin/netflow

# Create non-root user (note: will still need NET_RAW capability)
RUN useradd -r -s /bin/false netflow

# Set working directory
WORKDIR /data

# Expose no ports by default (monitoring tool)

# Add health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD netflow --version || exit 1

# Note: Container must run with --cap-add=NET_RAW and --cap-add=NET_ADMIN
# and --network=host to monitor host network

ENTRYPOINT ["/usr/local/bin/netflow"]
CMD ["--help"]