FROM tomcat:11.0.0-M1-jdk11

# Clean from default webapp
RUN rm -rf /usr/local/tomcat/webapps/*

# Create a vulnerable webapp
RUN mkdir -p /usr/local/tomcat/webapps/ROOT/WEB-INF
RUN mkdir -p /usr/local/tomcat/webapps/ROOT/protected

# Create a public and a protected resource
RUN echo "Public Area" > /usr/local/tomcat/webapps/ROOT/index.html
RUN echo "CONFIDENTIAL DATA - CVE-2026-43512 EXPLOITED" > /usr/local/tomcat/webapps/ROOT/protected/secret.html

# Copy configurations
COPY web.xml /usr/local/tomcat/webapps/ROOT/WEB-INF/web.xml
COPY tomcat-users.xml /usr/local/tomcat/conf/tomcat-users.xml
COPY server.xml /usr/local/tomcat/conf/server.xml

# Copt verbose logging configurations
COPY logging.properties /usr/local/tomcat/conf/logging.properties

EXPOSE 8080