ARG BASE_IMAGE=docker.io/kalilinux/kali-rolling@sha256:f49124869e4eee549315879c3bd7ef92f23b8753fec7544537bcec1493277096
FROM ${BASE_IMAGE}

ARG APT_SUITE=kali-rolling
ARG PIP_VERSION=26.2.1
ARG SEMGREP_VERSION=1.172.0
ARG NEWMAN_VERSION=6.2.2
ARG WSCAT_VERSION=6.1.0
ARG KATANA_VERSION=v1.7.0
ARG GRPCURL_VERSION=v1.9.3
ARG HTTPX_VERSION=v1.10.0
ARG WEBSOCAT_VERSION=1.14.1

LABEL org.opencontainers.image.title="Oryon Pentest sandbox" \
      org.opencontainers.image.version="0.1.0" \
      org.opencontainers.image.source="https://github.com/Guayamose/Oryon-Pentest"

ENV DEBIAN_FRONTEND=noninteractive
ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

RUN if [ -f /etc/apt/sources.list.d/kali.sources ]; then \
      sed -i "s/^Suites: .*/Suites: ${APT_SUITE}/" /etc/apt/sources.list.d/kali.sources; \
    elif [ -f /etc/apt/sources.list.d/kali.source ]; then \
      sed -i "s/^Suites: .*/Suites: ${APT_SUITE}/" /etc/apt/sources.list.d/kali.source; \
    else \
      printf '%s\n' "deb http://http.kali.org/kali ${APT_SUITE} main contrib non-free non-free-firmware" > /etc/apt/sources.list; \
    fi \
    && apt-get update \
    && apt-get install -y --no-install-recommends \
      bash ca-certificates coreutils curl wget git jq python3 python3-pip python3-venv nodejs npm \
      pkg-config libssl-dev \
      httpie yq ripgrep fd-find sed gawk grep tar zip unzip p7zip-full file binutils xxd \
      openssl netcat-traditional ncat socat sqlite3 nmap ffuf gobuster \
      dirsearch sqlmap sslscan sslyze \
      exiftool binwalk trufflehog gitleaks \
      golang-go cargo \
    && rm -rf /var/lib/apt/lists/*

RUN ln -sf /usr/bin/fdfind /usr/local/bin/fd

RUN python3 -m venv /opt/oryon-pentest/venvs/python-tools \
    && /opt/oryon-pentest/venvs/python-tools/bin/python -m pip install --no-cache-dir "pip==${PIP_VERSION}" \
    && /opt/oryon-pentest/venvs/python-tools/bin/python -m pip install --no-cache-dir \
      "semgrep==${SEMGREP_VERSION}"

RUN ln -sf /opt/oryon-pentest/venvs/python-tools/bin/semgrep /usr/local/bin/semgrep

RUN npm install -g --force "newman@${NEWMAN_VERSION}" "wscat@${WSCAT_VERSION}"

RUN go install "github.com/projectdiscovery/katana/cmd/katana@${KATANA_VERSION}" \
    && go install "github.com/fullstorydev/grpcurl/cmd/grpcurl@${GRPCURL_VERSION}" \
    && go install "github.com/projectdiscovery/httpx/cmd/httpx@${HTTPX_VERSION}" \
    && cp /root/go/bin/* /usr/local/bin/

RUN cargo install --locked --version "${WEBSOCAT_VERSION}" websocat \
    && cp /root/.cargo/bin/websocat /usr/local/bin/

ENV SEMGREP_ENABLE_VERSION_CHECK=0

COPY manifest.json /opt/oryon-pentest/manifest.json
COPY health_manifest.json /opt/oryon-pentest/health_manifest.json
COPY sandbox/verify_manifest.py /opt/oryon-pentest/verify_manifest.py

RUN useradd -m -u 1000 oryon_pentest
USER oryon_pentest
WORKDIR /workspace

CMD ["/bin/bash"]
