iq4u8/evidzone

1# ══════════════════════════════════════════════════════════2# 🔒 Security Hardened by: Sherlock 🕵️3# 🛡️ Production-grade: tini init, health checks,4#    proper permissions, dual runtime5# ══════════════════════════════════════════════════════════6FROM ubuntu:22.047 8ENV DEBIAN_FRONTEND=noninteractive9 10# ── 1. SYSTEM PACKAGES ──────────────────────────────────11RUN apt-get update && apt-get install -y --no-install-recommends \12    tini \13    python3.10 python3.10-venv python3.10-dev python3-pip \14    curl git wget sudo nano unzip zip tar tmux htop \15    make g++ build-essential ca-certificates \16    dnsutils iputils-ping net-tools psmisc procps \17    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \18    && apt-get install -y nodejs \19    && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*20 21# ── 2. PYTHON SETUP ─────────────────────────────────────22ENV PYTHONPATH="/usr/local/lib/python3.10/dist-packages:/usr/lib/python3/dist-packages"23ENV PATH="/usr/local/bin:/usr/bin:/usr/sbin:/bin:${PATH}"24ENV PYTHONDONTWRITEBYTECODE=125ENV PYTHONUNBUFFERED=126 27RUN update-alternatives --install /usr/bin/python python /usr/bin/python3.10 1 && \28    pip3 install --upgrade pip setuptools wheel && \29    pip3 install --no-cache-dir \30        "python-telegram-bot>=20.0" \31        "httpx[socks]>=0.24.0" \32        "requests>=2.31.0"33 34# ── 3. NODE.JS ENV ──────────────────────────────────────35ENV NODE_ENV=production36ENV NODE_OPTIONS="--max-old-space-size=400"37 38# ── 4. APP SETUP ────────────────────────────────────────39WORKDIR /app40COPY package.json .41RUN npm install --production && npm cache clean --force42COPY . .43 44# ── 5. USER & PERMISSIONS ───────────────────────────────45RUN useradd -m -s /bin/bash -u 1000 appuser && \46    echo "appuser ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && \47    mkdir -p /data/Users /app/backup/Users /tmp/uploads /tmp/bot_data && \48    chown -R appuser:appuser /app /data /tmp/uploads /tmp/bot_data && \49    chmod -R 777 /app /data /tmp/uploads /tmp/bot_data && \50    chmod +x start.sh51 52# ── 6. EXPOSE & HEALTH CHECK ────────────────────────────53EXPOSE 786054 55HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \56    CMD curl -sf http://localhost:7860/healthz || exit 157 58# ── 7. RUN ──────────────────────────────────────────────59USER appuser60ENTRYPOINT ["tini", "--"]61CMD ["./start.sh"]