# ops-readonly (episode 11): the read-only executor behind the security report
# agents. python3-systemd is the only extra, it reads the host journal through
# libsystemd from a read-only bind mount. No docker client in here on purpose.
FROM debian:trixie-slim
RUN apt-get update \
 && apt-get install -y --no-install-recommends python3 python3-systemd \
 && rm -rf /var/lib/apt/lists/*
COPY reader.py /reader.py
EXPOSE 8098
CMD ["python3", "-u", "/reader.py"]