#!/usr/bin/env python3
"""Distroless container image analysis agent using Trivy for comparing image security posture."""

import argparse
import json
import logging
import os
import subprocess
from datetime import datetime
from typing import Dict, List

logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(message)s")
logger = logging.getLogger(__name__)


def run_trivy_scan(image: str) -> dict:
    """Scan image with Trivy and return JSON results."""
    cmd = ["trivy", "image", "--format", "json", "--severity", "CRITICAL,HIGH,MEDIUM", image]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
        if result.stdout:
            return json.loads(result.stdout)
    except (FileNotFoundError, subprocess.TimeoutExpired, json.JSONDecodeError) as exc:
        logger.error("Trivy scan failed for %s: %s", image, exc)
    return {}


def get_image_size(image: str) -> int:
    """Get image size using docker inspect."""
    try:
        result = subprocess.run(
            ["docker", "inspect", "--format", "{{.Size}}", image],
            capture_output=True, text=True, timeout=30)
        return int(result.stdout.strip()) if result.stdout.strip() else 0
    except (FileNotFoundError, ValueError):
        return 0


def count_packages(scan_data: dict) -> int:
    """Count total packages found in Trivy scan."""
    count = 0
    for result in scan_data.get("Results", []):
        count += len(result.get("Vulnerabilities", []))
    return count


def count_vulns_by_severity(scan_data: dict) -> dict:
    """Count vulnerabilities by severity from Trivy results."""
    counts = {"CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0}
    for result in scan_data.get("Results", []):
        for vuln in result.get("Vulnerabilities", []):
            sev = vuln.get("Severity", "").upper()
            if sev in counts:
                counts[sev] += 1
    counts["total"] = sum(counts.values())
    return counts


def compare_images(base_image: str, distroless_image: str) -> dict:
    """Compare a standard base image against its distroless equivalent."""
    base_scan = run_trivy_scan(base_image)
    distroless_scan = run_trivy_scan(distroless_image)
    base_vulns = count_vulns_by_severity(base_scan)
    distroless_vulns = count_vulns_by_severity(distroless_scan)
    base_size = get_image_size(base_image)
    distroless_size = get_image_size(distroless_image)
    size_reduction = ((base_size - distroless_size) / base_size * 100) if base_size else 0
    vuln_reduction = ((base_vulns["total"] - distroless_vulns["total"]) / base_vulns["total"] * 100) if base_vulns["total"] else 0
    return {
        "base_image": {"image": base_image, "size_bytes": base_size, "vulnerabilities": base_vulns},
        "distroless_image": {"image": distroless_image, "size_bytes": distroless_size, "vulnerabilities": distroless_vulns},
        "size_reduction_pct": round(size_reduction, 1),
        "vuln_reduction_pct": round(vuln_reduction, 1),
    }


def check_distroless_properties(image: str) -> dict:
    """Check if an image exhibits distroless properties (no shell, no package manager)."""
    checks = {"has_shell": False, "has_package_manager": False, "has_user": False}
    try:
        result = subprocess.run(
            ["docker", "run", "--rm", "--entrypoint", "", image, "sh", "-c", "echo shell_exists"],
            capture_output=True, text=True, timeout=10)
        checks["has_shell"] = "shell_exists" in result.stdout
    except (FileNotFoundError, subprocess.TimeoutExpired):
        pass
    try:
        for pm in ["apt", "apk", "yum", "dnf"]:
            result = subprocess.run(
                ["docker", "run", "--rm", "--entrypoint", "", image, "which", pm],
                capture_output=True, text=True, timeout=10)
            if result.returncode == 0:
                checks["has_package_manager"] = True
                break
    except (FileNotFoundError, subprocess.TimeoutExpired):
        pass
    return checks


def generate_report(images: List[str], distroless_pairs: Dict[str, str] = None) -> dict:
    """Generate distroless adoption report."""
    report = {"analysis_date": datetime.utcnow().isoformat(), "image_scans": [], "comparisons": []}
    for image in images:
        scan = run_trivy_scan(image)
        vulns = count_vulns_by_severity(scan)
        props = check_distroless_properties(image)
        report["image_scans"].append({
            "image": image, "vulnerabilities": vulns, "properties": props,
            "is_minimal": not props["has_shell"] and not props["has_package_manager"],
        })
    if distroless_pairs:
        for base, distroless in distroless_pairs.items():
            report["comparisons"].append(compare_images(base, distroless))
    report["summary"] = {
        "images_scanned": len(images),
        "minimal_images": sum(1 for s in report["image_scans"] if s["is_minimal"]),
    }
    return report


def main():
    parser = argparse.ArgumentParser(description="Distroless Container Image Analysis Agent")
    parser.add_argument("--images", nargs="+", required=True, help="Images to analyze")
    parser.add_argument("--compare", nargs=2, action="append", metavar=("BASE", "DISTROLESS"),
                        help="Compare base vs distroless pairs")
    parser.add_argument("--output-dir", default=".")
    parser.add_argument("--output", default="distroless_report.json")
    args = parser.parse_args()

    os.makedirs(args.output_dir, exist_ok=True)
    pairs = {c[0]: c[1] for c in args.compare} if args.compare else None
    report = generate_report(args.images, pairs)
    out_path = os.path.join(args.output_dir, args.output)
    with open(out_path, "w") as f:
        json.dump(report, f, indent=2)
    logger.info("Report saved to %s", out_path)
    print(json.dumps(report["summary"], indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Container Image Base Analysis Tool

Analyzes container images to identify non-minimal base images and
recommends distroless alternatives based on the application runtime.
"""

import json
import subprocess
import sys
import argparse
from datetime import datetime


DISTROLESS_RECOMMENDATIONS = {
    "golang": "gcr.io/distroless/static-debian12:nonroot",
    "go": "gcr.io/distroless/static-debian12:nonroot",
    "rust": "gcr.io/distroless/static-debian12:nonroot",
    "java": "gcr.io/distroless/java21-debian12:nonroot",
    "openjdk": "gcr.io/distroless/java21-debian12:nonroot",
    "python": "gcr.io/distroless/python3-debian12:nonroot",
    "node": "gcr.io/distroless/nodejs22-debian12:nonroot",
    "nodejs": "gcr.io/distroless/nodejs22-debian12:nonroot",
    "dotnet": "mcr.microsoft.com/dotnet/runtime-deps:8.0-noble-chiseled",
    "ruby": "gcr.io/distroless/base-debian12:nonroot",
    "c": "gcr.io/distroless/cc-debian12:nonroot",
    "cpp": "gcr.io/distroless/cc-debian12:nonroot",
}

BLOATED_BASES = {"ubuntu", "debian", "centos", "fedora", "amazonlinux", "oraclelinux"}


def run_command(cmd: list[str], timeout: int = 60) -> str:
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return result.stdout.strip()
    except (subprocess.TimeoutExpired, FileNotFoundError):
        return ""


def get_image_info(image: str) -> dict:
    """Get image metadata using docker inspect or crane."""
    output = run_command(["docker", "inspect", image])
    if output:
        try:
            data = json.loads(output)
            if data:
                return data[0]
        except json.JSONDecodeError:
            pass
    return {}


def analyze_image_layers(image: str) -> dict:
    """Analyze image layers and size."""
    info = get_image_info(image)
    if not info:
        return {"error": f"Cannot inspect image: {image}"}

    return {
        "image": image,
        "size_bytes": info.get("Size", 0),
        "size_mb": round(info.get("Size", 0) / 1024 / 1024, 1),
        "layers": len(info.get("RootFS", {}).get("Layers", [])),
        "os": info.get("Os", ""),
        "architecture": info.get("Architecture", ""),
        "user": info.get("Config", {}).get("User", "root"),
        "entrypoint": info.get("Config", {}).get("Entrypoint", []),
        "cmd": info.get("Config", {}).get("Cmd", []),
        "env": info.get("Config", {}).get("Env", []),
        "has_shell": check_shell_exists(image),
    }


def check_shell_exists(image: str) -> bool:
    """Check if the image contains a shell."""
    for shell in ["/bin/sh", "/bin/bash", "/bin/dash"]:
        output = run_command(["docker", "run", "--rm", "--entrypoint", "",
                             image, "test", "-f", shell])
        # If command succeeds, shell exists
    output = run_command(["docker", "run", "--rm", "--entrypoint", "",
                         image, "ls", "/bin/sh"], timeout=10)
    return bool(output)


def scan_vulnerabilities(image: str) -> dict:
    """Scan image for vulnerabilities using trivy."""
    output = run_command(["trivy", "image", "--format", "json", "--quiet", image], timeout=120)
    if not output:
        return {"total": -1, "critical": -1, "high": -1, "medium": -1, "low": -1}

    try:
        data = json.loads(output)
        counts = {"total": 0, "critical": 0, "high": 0, "medium": 0, "low": 0}
        for result in data.get("Results", []):
            for vuln in result.get("Vulnerabilities", []):
                counts["total"] += 1
                sev = vuln.get("Severity", "").lower()
                if sev in counts:
                    counts[sev] += 1
        return counts
    except json.JSONDecodeError:
        return {"total": -1, "critical": -1, "high": -1, "medium": -1, "low": -1}


def recommend_distroless(image: str) -> str:
    """Recommend a distroless base image based on current image."""
    image_lower = image.lower()
    for runtime, distroless in DISTROLESS_RECOMMENDATIONS.items():
        if runtime in image_lower:
            return distroless
    return "gcr.io/distroless/base-debian12:nonroot"


def analyze_kubernetes_images(namespace: str = "") -> list[dict]:
    """Analyze all container images in a Kubernetes cluster."""
    cmd = ["kubectl", "get", "pods", "-o", "json"]
    if namespace:
        cmd.extend(["-n", namespace])
    else:
        cmd.append("--all-namespaces")

    output = run_command(cmd)
    if not output:
        return []

    images = set()
    try:
        data = json.loads(output)
        for pod in data.get("items", []):
            for cs in pod.get("status", {}).get("containerStatuses", []):
                images.add(cs.get("image", ""))
    except json.JSONDecodeError:
        return []

    results = []
    for image in sorted(images):
        if not image:
            continue
        is_distroless = "distroless" in image or "chiseled" in image
        is_bloated = any(base in image.lower() for base in BLOATED_BASES)

        results.append({
            "image": image,
            "is_distroless": is_distroless,
            "is_bloated_base": is_bloated,
            "recommendation": "Already minimal" if is_distroless else recommend_distroless(image)
        })

    return results


def generate_report(results: list[dict], output_format: str = "text") -> str:
    if output_format == "json":
        return json.dumps({"timestamp": datetime.utcnow().isoformat(),
                          "results": results}, indent=2)

    lines = ["=" * 70, "CONTAINER IMAGE BASE ANALYSIS REPORT",
             f"Generated: {datetime.utcnow().isoformat()}", "=" * 70]

    minimal = [r for r in results if r.get("is_distroless")]
    bloated = [r for r in results if r.get("is_bloated_base")]
    lines.append(f"\nImages Analyzed: {len(results)}")
    lines.append(f"Minimal/Distroless: {len(minimal)}")
    lines.append(f"Bloated Base: {len(bloated)}")

    if bloated:
        lines.append("\n## Images Needing Migration")
        for r in bloated:
            lines.append(f"  {r['image']}")
            lines.append(f"    Recommended: {r['recommendation']}")

    lines.append("\n" + "=" * 70)
    return "\n".join(lines)


def main():
    parser = argparse.ArgumentParser(description="Container Image Base Analyzer")
    parser.add_argument("--image", help="Analyze a specific image")
    parser.add_argument("--namespace", default="", help="K8s namespace to scan")
    parser.add_argument("--format", choices=["text", "json"], default="text")
    args = parser.parse_args()

    if args.image:
        info = analyze_image_layers(args.image)
        info["recommendation"] = recommend_distroless(args.image)
        print(generate_report([info], args.format))
    else:
        results = analyze_kubernetes_images(args.namespace)
        print(generate_report(results, args.format))


if __name__ == "__main__":
    main()