#!/usr/bin/env python3
"""Container drift detection agent using Docker SDK.

Compares running container filesystem against the original image to detect
binary drift, file modifications, and package installations.
"""

import argparse
import json
import subprocess
import sys
from datetime import datetime

try:
    import docker
except ImportError:
    print("Install docker SDK: pip install docker")
    sys.exit(1)

PACKAGE_MANAGERS = {"apt", "apt-get", "yum", "dnf", "apk", "pip", "pip3", "npm", "gem"}
SHELLS = {"bash", "sh", "dash", "zsh", "csh", "ash"}
SUSPICIOUS_BINARIES = {"curl", "wget", "nc", "ncat", "netcat", "socat", "python",
                       "perl", "gcc", "cc", "make", "nmap", "tcpdump"}


def get_container_diff(client, container_id):
    container = client.containers.get(container_id)
    try:
        diff = container.diff()
    except docker.errors.APIError:
        diff = []
    changes = {"added": [], "modified": [], "deleted": []}
    for entry in diff or []:
        path = entry.get("Path", "")
        kind = entry.get("Kind", 0)
        if kind == 0:
            changes["modified"].append(path)
        elif kind == 1:
            changes["added"].append(path)
        elif kind == 2:
            changes["deleted"].append(path)
    return changes


def get_running_processes(container_id):
    try:
        result = subprocess.run(
            ["docker", "top", container_id, "-eo", "pid,user,comm,args"],
            capture_output=True, text=True, timeout=10)
        if result.returncode != 0:
            return []
        lines = result.stdout.strip().split("\n")[1:]
        processes = []
        for line in lines:
            parts = line.split(None, 3)
            if len(parts) >= 3:
                processes.append({
                    "pid": parts[0], "user": parts[1],
                    "command": parts[2], "args": parts[3] if len(parts) > 3 else ""
                })
        return processes
    except (subprocess.TimeoutExpired, FileNotFoundError):
        return []


def detect_drift_indicators(changes, processes):
    findings = []
    for path in changes.get("added", []):
        basename = path.rsplit("/", 1)[-1]
        if basename in SUSPICIOUS_BINARIES:
            findings.append({"type": "suspicious_binary_added", "path": path,
                             "severity": "HIGH"})
        if path.startswith("/usr/bin/") or path.startswith("/usr/sbin/"):
            findings.append({"type": "binary_added_to_system_path", "path": path,
                             "severity": "HIGH"})
    for path in changes.get("modified", []):
        if path in ("/etc/passwd", "/etc/shadow", "/etc/sudoers"):
            findings.append({"type": "sensitive_file_modified", "path": path,
                             "severity": "CRITICAL"})
        if path.startswith("/etc/cron"):
            findings.append({"type": "cron_modified", "path": path, "severity": "HIGH"})

    for proc in processes:
        cmd = proc.get("command", "")
        if cmd in PACKAGE_MANAGERS:
            findings.append({"type": "package_manager_running", "process": cmd,
                             "severity": "HIGH"})
        if cmd in SHELLS and proc.get("user") == "root":
            findings.append({"type": "root_shell_active", "process": cmd,
                             "severity": "MEDIUM"})
    return findings


def check_image_digest(client, container_id):
    container = client.containers.get(container_id)
    image_id = container.image.id
    image_tags = container.image.tags
    attrs = container.attrs
    config_image = attrs.get("Config", {}).get("Image", "")
    uses_digest = "@sha256:" in config_image
    return {
        "image_id": image_id[:19],
        "image_tags": image_tags,
        "config_image": config_image,
        "uses_immutable_digest": uses_digest,
        "privileged": attrs.get("HostConfig", {}).get("Privileged", False),
        "read_only_rootfs": attrs.get("HostConfig", {}).get("ReadonlyRootfs", False),
    }


def audit_container(client, container_id):
    changes = get_container_diff(client, container_id)
    processes = get_running_processes(container_id)
    findings = detect_drift_indicators(changes, processes)
    image_info = check_image_digest(client, container_id)

    if not image_info.get("read_only_rootfs"):
        findings.append({"type": "mutable_rootfs", "severity": "MEDIUM",
                         "detail": "readOnlyRootFilesystem not enabled"})
    if image_info.get("privileged"):
        findings.append({"type": "privileged_container", "severity": "CRITICAL",
                         "detail": "Container running in privileged mode"})

    total_changes = sum(len(v) for v in changes.values())
    risk = "CRITICAL" if any(f["severity"] == "CRITICAL" for f in findings) else \
           "HIGH" if total_changes > 20 or any(f["severity"] == "HIGH" for f in findings) else \
           "MEDIUM" if total_changes > 5 else "LOW"

    return {
        "container_id": container_id,
        "timestamp": datetime.utcnow().isoformat() + "Z",
        "filesystem_changes": changes,
        "total_changes": total_changes,
        "running_processes": processes,
        "image_info": image_info,
        "findings": findings,
        "risk_level": risk,
    }


def main():
    parser = argparse.ArgumentParser(description="Container Drift Detector")
    parser.add_argument("--container", required=True, help="Container ID or name")
    parser.add_argument("--all", action="store_true", help="Audit all running containers")
    args = parser.parse_args()

    client = docker.from_env()
    results = []
    if args.all:
        for c in client.containers.list():
            results.append(audit_container(client, c.id))
    else:
        results.append(audit_container(client, args.container))

    print(json.dumps(results, indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Container Drift Detection Tool

Compares running containers against their original image state
to detect filesystem drift, unexpected processes, and configuration changes.
"""

import json
import subprocess
import sys
import argparse
from datetime import datetime
from collections import defaultdict


def run_command(cmd: list[str], timeout: int = 30) -> str:
    """Execute a command and return stdout."""
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return result.stdout.strip()
    except (subprocess.TimeoutExpired, FileNotFoundError):
        return ""


def get_running_containers(namespace: str = "") -> list[dict]:
    """Get running containers from Kubernetes."""
    cmd = ["kubectl", "get", "pods", "-o", "json"]
    if namespace:
        cmd.extend(["-n", namespace])
    else:
        cmd.append("--all-namespaces")

    output = run_command(cmd)
    if not output:
        return []

    try:
        data = json.loads(output)
        containers = []
        for pod in data.get("items", []):
            ns = pod["metadata"]["namespace"]
            pod_name = pod["metadata"]["name"]
            for cs in pod.get("status", {}).get("containerStatuses", []):
                containers.append({
                    "namespace": ns,
                    "pod": pod_name,
                    "container": cs["name"],
                    "image": cs["image"],
                    "imageID": cs.get("imageID", ""),
                    "ready": cs.get("ready", False),
                    "restartCount": cs.get("restartCount", 0),
                })
        return containers
    except (json.JSONDecodeError, KeyError):
        return []


def check_image_tag_drift(containers: list[dict]) -> list[dict]:
    """Detect containers using mutable tags instead of digests."""
    findings = []
    for c in containers:
        if "@sha256:" not in c["image"]:
            findings.append({
                "severity": "MEDIUM",
                "type": "mutable_tag",
                "namespace": c["namespace"],
                "pod": c["pod"],
                "container": c["container"],
                "image": c["image"],
                "description": f"Container uses mutable tag instead of digest: {c['image']}"
            })
    return findings


def check_readonly_filesystem(namespace: str = "") -> list[dict]:
    """Check which containers lack readOnlyRootFilesystem."""
    cmd = ["kubectl", "get", "pods", "-o", "json"]
    if namespace:
        cmd.extend(["-n", namespace])
    else:
        cmd.append("--all-namespaces")

    output = run_command(cmd)
    if not output:
        return []

    findings = []
    try:
        data = json.loads(output)
        for pod in data.get("items", []):
            ns = pod["metadata"]["namespace"]
            pod_name = pod["metadata"]["name"]
            for container in pod["spec"].get("containers", []):
                sc = container.get("securityContext", {})
                if not sc.get("readOnlyRootFilesystem", False):
                    findings.append({
                        "severity": "MEDIUM",
                        "type": "writable_filesystem",
                        "namespace": ns,
                        "pod": pod_name,
                        "container": container["name"],
                        "description": f"Container {container['name']} has writable root filesystem"
                    })
    except (json.JSONDecodeError, KeyError):
        pass

    return findings


def check_restart_anomalies(containers: list[dict], threshold: int = 3) -> list[dict]:
    """Detect containers with high restart counts (potential crash loops from drift)."""
    findings = []
    for c in containers:
        if c["restartCount"] >= threshold:
            findings.append({
                "severity": "LOW",
                "type": "high_restarts",
                "namespace": c["namespace"],
                "pod": c["pod"],
                "container": c["container"],
                "restarts": c["restartCount"],
                "description": f"Container has {c['restartCount']} restarts (may indicate instability from drift)"
            })
    return findings


def check_pod_security_standards(namespace: str = "") -> list[dict]:
    """Check namespace-level Pod Security Standards enforcement."""
    output = run_command(["kubectl", "get", "namespaces", "-o", "json"])
    if not output:
        return []

    findings = []
    try:
        data = json.loads(output)
        for ns in data.get("items", []):
            ns_name = ns["metadata"]["name"]
            if namespace and ns_name != namespace:
                continue
            labels = ns["metadata"].get("labels", {})
            enforce = labels.get("pod-security.kubernetes.io/enforce", "")
            if enforce not in ("restricted", "baseline"):
                findings.append({
                    "severity": "MEDIUM",
                    "type": "no_pss_enforcement",
                    "namespace": ns_name,
                    "enforce_level": enforce or "none",
                    "description": f"Namespace {ns_name} lacks Pod Security Standards enforcement"
                })
    except (json.JSONDecodeError, KeyError):
        pass

    return findings


def generate_report(containers: list[dict], all_findings: list[dict],
                    output_format: str = "text") -> str:
    """Generate drift detection report."""
    critical = [f for f in all_findings if f["severity"] == "CRITICAL"]
    high = [f for f in all_findings if f["severity"] == "HIGH"]
    medium = [f for f in all_findings if f["severity"] == "MEDIUM"]
    low = [f for f in all_findings if f["severity"] == "LOW"]

    if output_format == "json":
        return json.dumps({
            "timestamp": datetime.utcnow().isoformat(),
            "containers_scanned": len(containers),
            "findings": {"critical": len(critical), "high": len(high),
                        "medium": len(medium), "low": len(low)},
            "details": all_findings
        }, indent=2)

    lines = []
    lines.append("=" * 70)
    lines.append("CONTAINER DRIFT DETECTION REPORT")
    lines.append(f"Generated: {datetime.utcnow().isoformat()}")
    lines.append("=" * 70)
    lines.append(f"\nContainers Scanned: {len(containers)}")
    lines.append(f"Findings: {len(critical)} Critical, {len(high)} High, {len(medium)} Medium, {len(low)} Low")

    for severity, items in [("CRITICAL", critical), ("HIGH", high), ("MEDIUM", medium), ("LOW", low)]:
        if items:
            lines.append(f"\n## {severity} Findings")
            for f in items:
                lines.append(f"  [{f['type']}] {f['description']}")
                if "pod" in f:
                    lines.append(f"    Namespace: {f.get('namespace', 'N/A')} | Pod: {f.get('pod', 'N/A')}")

    lines.append("\n" + "=" * 70)
    return "\n".join(lines)


def main():
    parser = argparse.ArgumentParser(description="Container Drift Detection Tool")
    parser.add_argument("--namespace", default="", help="Kubernetes namespace to scan")
    parser.add_argument("--format", choices=["text", "json"], default="text")
    parser.add_argument("--restart-threshold", type=int, default=3)
    args = parser.parse_args()

    containers = get_running_containers(args.namespace)
    all_findings = []
    all_findings.extend(check_image_tag_drift(containers))
    all_findings.extend(check_readonly_filesystem(args.namespace))
    all_findings.extend(check_restart_anomalies(containers, args.restart_threshold))
    all_findings.extend(check_pod_security_standards(args.namespace))

    report = generate_report(containers, all_findings, args.format)
    print(report)


if __name__ == "__main__":
    main()