FROM debian:bookworm-slim

RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        python3 \
        krb5-user \
        dnsutils \
        ca-certificates && \
    rm -rf /var/lib/apt/lists/*

WORKDIR /app
COPY dns_sync.py .
COPY krb5.conf /etc/krb5.conf
RUN chmod +x dns_sync.py

USER nobody
ENTRYPOINT ["python3", "/app/dns_sync.py"]