# ---------------------------------------------------------------------------
# Lab image for "Computer Security: The Foundations".
#
# One image covers seven of the eight class activities.  See the instructor
# Lab Setup Guide for the full rationale and for Activity 8's scan-target
# requirement (which is NOT provided here -- you must supply a sanctioned
# target on your own network).
#
#   docker build -t seccourse-lab .
#   docker run --rm -it \
#       --cap-add=SYS_PTRACE --security-opt seccomp=unconfined \
#       seccourse-lab
#
# The two extra run flags let gdb work and let the buffer-overflow exercise
# run with ASLR disabled INSIDE THE CONTAINER only.  Do not add them to any
# other container.
#
# Pin the exact base tag; "latest" is what breaks Activity 11 on a future
# rebuild.  Update this digest deliberately, and re-test Activity 11 when you do.
# ---------------------------------------------------------------------------
FROM debian:12.6-slim

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y --no-install-recommends \
        build-essential gcc-multilib gdb curl ca-certificates \
        netcat-openbsd \
        python3 python3-pip python3-venv \
        openssl imagemagick libimage-exiftool-perl testdisk nmap \
        binutils file less vim-tiny unzip \
    && rm -rf /var/lib/apt/lists/*

# Python libraries the activities import.  --break-system-packages because the
# image is disposable and single-purpose; do not copy this into a real system.
RUN pip3 install --no-cache-dir --break-system-packages bcrypt pyopenssl pem

# Activity 2 needs the SecLists 10k dictionary.  Bake it in at build time so
# the exercise does not depend on GitHub being reachable from an exam network.
RUN mkdir -p /opt/lab/wordlists && \
    curl -fsSL -o /opt/lab/wordlists/10k-most-common.txt \
      https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/Common-Credentials/10k-most-common.txt \
    || echo "WARNING: dictionary download failed at build time; fetch it manually into /opt/lab/wordlists/"

# Activity 11 needs ASLR off.  A container cannot set this itself
# (/proc/sys/kernel/randomize_va_space is host-wide and read-only in the
# container), so it is done on the HOST, or the container is run with
# --security-opt seccomp=unconfined and ASLR is disabled on the host:
#     echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
# See the Lab Setup Guide, section "Activity 11".
#
# The starter files (simple_web_server.py, victim-2020, sample media) are on
# the companion website; fetch them into /opt/lab as needed, or COPY them in
# if you are building an offline image.

WORKDIR /opt/lab
CMD ["/bin/bash"]
