Dockerfile.runtime

###############################################################################
# ADscan runtime image (single source of truth)
#
# Build targets:
# - runtime-pro: uses compiled binary from dist/adscan (PyArmor/PyInstaller flow)
# - runtime-lite: uses open-source Python sources (no PyArmor/PyInstaller)
#
# This file centralizes all shared runtime dependencies/tools so LITE and PRO
# never drift when adding system packages or tooling.
###############################################################################

###############################################################################
# RustHound-CE build stage (Kerberos/GSSAPI enabled)
###############################################################################
FROM rust:1-bookworm AS rusthound_builder

ARG DEBIAN_FRONTEND=noninteractive
SHELL ["/bin/bash", "-euo", "pipefail", "-c"]

RUN apt-get update -y && apt-get install -y --no-install-recommends \
      ca-certificates \
      clang \
      pkg-config \
      libsasl2-dev \
      libkrb5-dev \
      libssl-dev \
      libldap2-dev \
    && rm -rf /var/lib/apt/lists/*

# Pin RustHound-CE version (must match ADscan expectations)
RUN cargo install --locked --version 2.4.7 rusthound-ce

###############################################################################
# Shared runtime base for both PRO and LITE images
###############################################################################
FROM debian:trixie-slim AS runtime-common

ARG DEBIAN_FRONTEND=noninteractive
ARG JOHN_BLEEDING_JUMBO_COMMIT=d8f5b0138e6f9fe24ab453f886dcaa2abb2e5407
ARG CREDSWEEPER_VERSION=1.15.1
ARG HASHCAT_VERSION=7.1.2
ARG LIGOLO_NG_VERSION=0.8.3
SHELL ["/bin/bash", "-euo", "pipefail", "-c"]

ENV ADSCAN_HOME=/opt/adscan \
    HOME=/opt/adscan \
    XDG_CONFIG_HOME=/opt/adscan/.config \
    NPM_CONFIG_UPDATE_NOTIFIER=false \
    PATH="/opt/adscan/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

RUN apt-get update -y && apt-get install -y --no-install-recommends \
      ca-certificates \
      curl \
      git \
      ripgrep \
      jq \
      bat \
      gosu \
      sudo \
      libcap2-bin \
      net-tools \
      iputils-ping \
      iproute2 \
      procps \
      unzip \
      p7zip-full \
      wget \
      rclone \
      xz-utils \
      bzip2 \
      python3 \
      python3-pip \
      python3-venv \
      python3-dev \
      nodejs \
      npm \
      build-essential \
      pkg-config \
      make \
      clang \
      llvm \
      libclang-dev \
      libffi-dev \
      libssl-dev \
      zlib1g-dev \
      libbz2-dev \
      libreadline-dev \
      libsqlite3-dev \
      libncurses-dev \
      libncursesw5-dev \
      tk-dev \
      liblzma-dev \
      libgmp-dev \
      libkrb5-dev \
      libgssapi-krb5-2 \
      libsasl2-2 \
      libsasl2-modules-gssapi-mit \
      krb5-user \
      libssl3t64 \
      libldap2 \
      libldns-dev \
      nmap \
      hydra \
      pocl-opencl-icd \
      samba \
      samba-common-bin \
      mono-devel \
      mingw-w64 \
      gcc-mingw-w64-x86-64 \
      musl-tools \
      tesseract-ocr \
      antiword \
      moreutils \
      libreoffice \
      graphviz \
      fontconfig \
      fonts-crosextra-carlito \
      fonts-crosextra-caladea \
      fonts-liberation \
      libmagic1 \
      freerdp3-x11 \
      ntpsec-ntpdate \
      unbound \
      unbound-anchor \
      dns-root-data \
    && mkdir -p /etc/OpenCL/vendors \
    && printf '%s\n' 'libnvidia-opencl.so.1' > /etc/OpenCL/vendors/nvidia.icd \
    && rm -rf /var/lib/apt/lists/*

# Codex CLI (official ChatGPT plan sign-in path for Plus/Pro subscriptions).
# Installed globally so `ask login codex` and `ask` can use `codex` directly.
RUN set -eux; \
  npm install --global @openai/codex; \
  codex --version

# Base runtime layout
RUN mkdir -p /opt/adscan/{bin,tools,tool_venvs,wordlists,logs,fonts} /workspaces \
  && fc-cache -f \
  && chmod -R 0777 /opt/adscan /workspaces

# Install Python tool environments (mirrors `PipToolsConfig` from adscan.py)
RUN set -eux; \
  python3 -m venv /opt/adscan/tool_venvs/impacket/venv; \
  /opt/adscan/tool_venvs/impacket/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/impacket/venv/bin/python -m pip install --no-cache-dir "impacket==0.13.0" "pycryptodome==3.23.0"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/netexec/venv; \
  /opt/adscan/tool_venvs/netexec/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/netexec/venv/bin/python -m pip install --no-cache-dir "git+https://github.com/Pennyw0rth/NetExec.git@f187717"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/certipy/venv; \
  /opt/adscan/tool_venvs/certipy/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/certipy/venv/bin/python -m pip install --no-cache-dir "certipy-ad==5.0.4"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/bloodyad/venv; \
  /opt/adscan/tool_venvs/bloodyad/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/bloodyad/venv/bin/python -m pip install --no-cache-dir "bloodyAD==2.5.1" "minikerberos==0.4.9"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/bloodhound-ce-py/venv; \
  /opt/adscan/tool_venvs/bloodhound-ce-py/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/bloodhound-ce-py/venv/bin/python -m pip install --no-cache-dir "bloodhound-ce==1.9.1"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/weakpass/venv; \
  /opt/adscan/tool_venvs/weakpass/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/weakpass/venv/bin/python -m pip install --no-cache-dir "weakpass-lookup"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/enum-trusts/venv; \
  /opt/adscan/tool_venvs/enum-trusts/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/enum-trusts/venv/bin/python -m pip install --no-cache-dir "git+https://github.com/ADScanPro/enum-trusts.git@f7eae14"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/manspider/venv; \
  /opt/adscan/tool_venvs/manspider/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/manspider/venv/bin/python -m pip install --no-cache-dir "git+https://github.com/ADScanPro/MANSPIDER@cedb138"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/credsweeper/venv; \
  /opt/adscan/tool_venvs/credsweeper/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/credsweeper/venv/bin/python -m pip install --no-cache-dir "credsweeper==${CREDSWEEPER_VERSION}"; \
  \
  python3 -m venv /opt/adscan/tool_venvs/pypykatz/venv; \
  /opt/adscan/tool_venvs/pypykatz/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/pypykatz/venv/bin/python -m pip install --no-cache-dir "pypykatz==0.6.13"; \
  \
  chmod -R 0777 /opt/adscan/tool_venvs

# External tools (git/curl)
RUN set -eux; \
  mkdir -p /opt/adscan/tools; \
  curl -fsSL "https://hashcat.net/files/hashcat-${HASHCAT_VERSION}.7z" -o /tmp/hashcat.7z; \
  7z x /tmp/hashcat.7z -o/opt/adscan/tools >/dev/null; \
  test -x "/opt/adscan/tools/hashcat-${HASHCAT_VERSION}/hashcat.bin"; \
  ln -sf "/opt/adscan/tools/hashcat-${HASHCAT_VERSION}/hashcat.bin" /opt/adscan/bin/hashcat; \
  /opt/adscan/bin/hashcat --version | grep -F "v${HASHCAT_VERSION}"; \
  rm -f /tmp/hashcat.7z; \
  \
  git clone --depth 1 https://github.com/Greenwolf/ntlm_theft.git /opt/adscan/tools/ntlm_theft; \
  mkdir -p /opt/adscan/tools/firepwd; \
  curl -fsSL https://raw.githubusercontent.com/lclevy/firepwd/refs/heads/master/firepwd.py -o /opt/adscan/tools/firepwd/firepwd.py; \
  curl -fsSL https://raw.githubusercontent.com/lclevy/firepwd/refs/heads/master/requirements.txt -o /opt/adscan/tools/firepwd/requirements.txt; \
  python3 -m venv /opt/adscan/tool_venvs/firepwd/venv; \
  /opt/adscan/tool_venvs/firepwd/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/firepwd/venv/bin/python -m pip install --no-cache-dir -r /opt/adscan/tools/firepwd/requirements.txt; \
  \
  git clone --depth 1 https://github.com/spextat0r/LSA-Reaper.git /opt/adscan/tools/LSA-Reaper; \
  python3 -m venv /opt/adscan/tool_venvs/LSA-Reaper/venv; \
  /opt/adscan/tool_venvs/LSA-Reaper/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/LSA-Reaper/venv/bin/python -m pip install --no-cache-dir -r /opt/adscan/tools/LSA-Reaper/requirements.txt; \
  \
  mkdir -p /opt/adscan/tools/PKINITtools; \
  curl -fsSL https://raw.githubusercontent.com/dirkjanm/PKINITtools/refs/heads/master/gettgtpkinit.py -o /opt/adscan/tools/PKINITtools/gettgtpkinit.py; \
  curl -fsSL https://raw.githubusercontent.com/dirkjanm/PKINITtools/refs/heads/master/getnthash.py -o /opt/adscan/tools/PKINITtools/getnthash.py; \
  curl -fsSL https://raw.githubusercontent.com/dirkjanm/PKINITtools/refs/heads/master/requirements.txt -o /opt/adscan/tools/PKINITtools/requirements.txt; \
  python3 -m venv /opt/adscan/tool_venvs/PKINITtools/venv; \
  /opt/adscan/tool_venvs/PKINITtools/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/PKINITtools/venv/bin/python -m pip install --no-cache-dir -r /opt/adscan/tools/PKINITtools/requirements.txt; \
  \
  mkdir -p /opt/adscan/tools/kerbrute; \
  curl -fsSL https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64 -o /opt/adscan/tools/kerbrute/kerbrute; \
  chmod +x /opt/adscan/tools/kerbrute/kerbrute; \
  \
  mkdir -p /opt/adscan/tools/ligolo-ng/proxy/linux-amd64; \
  curl -fsSL \
    "https://github.com/nicocha30/ligolo-ng/releases/download/v${LIGOLO_NG_VERSION}/ligolo-ng_proxy_${LIGOLO_NG_VERSION}_linux_amd64.tar.gz" \
    -o /tmp/ligolo_proxy.tar.gz; \
  tar -xzf /tmp/ligolo_proxy.tar.gz -C /opt/adscan/tools/ligolo-ng/proxy/linux-amd64 proxy; \
  chmod +x /opt/adscan/tools/ligolo-ng/proxy/linux-amd64/proxy; \
  setcap cap_net_admin,cap_net_bind_service+ep /opt/adscan/tools/ligolo-ng/proxy/linux-amd64/proxy; \
  ln -sf /opt/adscan/tools/ligolo-ng/proxy/linux-amd64/proxy /opt/adscan/bin/ligolo-proxy; \
  rm -f /tmp/ligolo_proxy.tar.gz; \
  \
  mkdir -p /opt/adscan/tools/ligolo-ng/agent/windows-amd64; \
  curl -fsSL \
    "https://github.com/nicocha30/ligolo-ng/releases/download/v${LIGOLO_NG_VERSION}/ligolo-ng_agent_${LIGOLO_NG_VERSION}_windows_amd64.zip" \
    -o /tmp/ligolo_agent_windows_amd64.zip; \
  unzip -q /tmp/ligolo_agent_windows_amd64.zip agent.exe -d /opt/adscan/tools/ligolo-ng/agent/windows-amd64; \
  rm -f /tmp/ligolo_agent_windows_amd64.zip; \
  \
  git clone --depth 1 https://github.com/lgandx/Responder.git /opt/adscan/tools/responder; \
  python3 -m venv /opt/adscan/tool_venvs/responder/venv; \
  /opt/adscan/tool_venvs/responder/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/tool_venvs/responder/venv/bin/python -m pip install --no-cache-dir -r /opt/adscan/tools/responder/requirements.txt; \
  \
  git clone https://github.com/openwall/john.git /opt/adscan/tools/john; \
  git -C /opt/adscan/tools/john checkout "${JOHN_BLEEDING_JUMBO_COMMIT}"; \
  ( \
    cd /opt/adscan/tools/john/src && \
    ./configure && \
    make -s clean && \
    make -sj"$(nproc)" \
  ); \
  for tool in john keepass2john keepass2john.py zip2john zip2john.py pfx2john pfx2john.py ansible2john ansible2john.py; do \
    if [ -e "/opt/adscan/tools/john/run/${tool}" ]; then \
      chmod +x "/opt/adscan/tools/john/run/${tool}" || true; \
      ln -sf "/opt/adscan/tools/john/run/${tool}" "/opt/adscan/bin/${tool}"; \
    fi; \
  done; \
  if [ -e "/opt/adscan/tools/john/run/john.conf" ]; then \
    ln -sf "/opt/adscan/tools/john/run/john.conf" "/opt/adscan/bin/john.conf"; \
  fi; \
  \
  git clone --depth 1 https://github.com/blechschmidt/massdns.git /opt/adscan/tools/massdns; \
  make -C /opt/adscan/tools/massdns; \
  chmod +x /opt/adscan/tools/massdns/bin/massdns; \
  ln -sf /opt/adscan/tools/massdns/bin/massdns /opt/adscan/bin/massdns; \
  \
  chmod -R 0777 /opt/adscan/tools /opt/adscan/tool_venvs

# Wordlists
RUN set -eux; \
  mkdir -p /opt/adscan/wordlists; \
  curl -fsSL https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt -o /opt/adscan/wordlists/rockyou.txt; \
  curl -fsSL https://gist.github.com/The-Viper-One/a1ee60d8b3607807cc387d794e809f0b/raw/b7d83af6a8bbb43013e04f78328687d19d0cf9a7/kerberoast_pws.xz -o /opt/adscan/wordlists/kerberoast_pws.xz; \
  xz -d -c /opt/adscan/wordlists/kerberoast_pws.xz > /opt/adscan/wordlists/kerberoast_pws; \
  curl -fsSL https://weakpass.com/download/2073/hashmob.net_2025.medium.found.7z -o /opt/adscan/wordlists/hashmob.net_2025.medium.found.7z; \
  7z x -y -o/opt/adscan/wordlists /opt/adscan/wordlists/hashmob.net_2025.medium.found.7z; \
  curl -fsSL https://weakpass.com/download/1938/kaonashi14M.txt.7z -o /opt/adscan/wordlists/kaonashi14M.txt.7z; \
  7z x -y -o/opt/adscan/wordlists /opt/adscan/wordlists/kaonashi14M.txt.7z; \
  rm -f /opt/adscan/wordlists/kerberoast_pws.xz; \
  rm -f /opt/adscan/wordlists/hashmob.net_2025.medium.found.7z; \
  rm -f /opt/adscan/wordlists/kaonashi14M.txt.7z; \
  chmod -R 0777 /opt/adscan/wordlists

# RustHound-CE (Kerberos-capable build)
COPY --from=rusthound_builder /usr/local/cargo/bin/rusthound-ce /usr/local/bin/rusthound-ce
RUN rusthound-ce --version

# Unbound container configuration
COPY docker/unbound_container_base.conf /etc/unbound/unbound.conf
COPY docker/unbound_adscan_control.conf /etc/unbound/unbound.conf.d/00-adscan-control.conf

COPY docker/adscan_entrypoint.sh /usr/local/bin/adscan-entrypoint
RUN chmod +x /usr/local/bin/adscan-entrypoint

###############################################################################
# PRO target: compiled binary runtime
###############################################################################
FROM runtime-common AS runtime-pro

COPY dist/adscan /usr/local/bin/adscan
RUN chmod +x /usr/local/bin/adscan

ENTRYPOINT ["/usr/local/bin/adscan-entrypoint"]

###############################################################################
# LITE target: source runtime (open-source)
###############################################################################
FROM runtime-common AS runtime-lite

# Runtime Python dependencies for source-mode ADscan CLI.
RUN set -eux; \
  python3 -m venv /opt/adscan/venv; \
  /opt/adscan/venv/bin/python -m pip install --no-cache-dir -U pip; \
  /opt/adscan/venv/bin/python -m pip install --no-cache-dir \
    prompt_toolkit==3.0.52 \
    psutil==7.2.2 \
    rich==13.9.4 \
    python-docx==1.2.0 \
    netifaces==0.11.0 \
    neo4j==6.1.0 \
    posthog==7.9.3 \
    certifi==2026.1.4 \
    ipaddress==1.0.23 \
    python-dotenv==1.2.1 \
    sentry-sdk==2.52.0 \
    packaging==25.0 \
    questionary==2.1.1 \
    pypsrp==0.9.0 \
    pydantic-settings==2.13.1 \
    pydantic-ai==1.62.0 \
    python-magic==0.4.27 \
    markitdown==0.1.5 \
    credsweeper==${CREDSWEEPER_VERSION} \
    pykeepass==4.1.1.post1 \
    impacket==0.13.0 \
    pycryptodome==3.23.0 \
    gpp-decrypt==2.0.0 \
    requests==2.32.5 \
    matplotlib==3.10.8 \
    graphviz==0.21

COPY adscan.py /opt/adscan-src/adscan.py
COPY adscan_core /opt/adscan-src/adscan_core
COPY adscan_internal /opt/adscan-src/adscan_internal
COPY adscan_launcher /opt/adscan-src/adscan_launcher
COPY custom_config.yaml /opt/adscan-src/custom_config.yaml
COPY pyproject.toml /opt/adscan-src/pyproject.toml

# Normalize source permissions to avoid host-side restrictive modes leaking into
# the image (e.g. 0700 dirs), which can break imports when running as the
# non-root `adscan` user.
RUN chmod -R a+rX /opt/adscan-src

# Safety assertions: LITE image must not contain private modules.
RUN test ! -d /opt/adscan-src/adscan_internal/pro
RUN test ! -d /opt/adscan-src/adscan_internal/reporting
RUN test ! -f /opt/adscan-src/adscan_internal/services/report_service.py
RUN test ! -f /opt/adscan-src/adscan_internal/report_generator.py

ENV PYTHONPATH=/opt/adscan-src

RUN printf '%s\n' \
  '#!/usr/bin/env bash' \
  'set -euo pipefail' \
  'exec /opt/adscan/venv/bin/python /opt/adscan-src/adscan.py "$@"' \
  > /usr/local/bin/adscan \
  && chmod +x /usr/local/bin/adscan

ENTRYPOINT ["/usr/local/bin/adscan-entrypoint"]