Dockerfile

# ==========================================
# Stage 1: Build Binwalk 3.1.0 in Rust
# ==========================================
FROM rust:1-bookworm AS binwalk-builder
RUN cargo install binwalk --version 3.1.0 --root /install

# ==========================================
# Stage 2: Main Production Image
# ==========================================
FROM node:24-bookworm-slim

ENV DEBIAN_FRONTEND=noninteractive
ENV PORT=7860
EXPOSE 7860

# ------------------------------------------
# 1. Browser Hard-Block (APT Pinning)
# ------------------------------------------
RUN mkdir -p /etc/apt/preferences.d && \
    printf 'Package: *chromium* *chrome* *firefox* *playwright* *puppeteer* *webkit* *geckodriver* *chromedriver* *electron*\nPin: release *\nPin-Priority: -1\n' > /etc/apt/preferences.d/99-block-browsers

# ------------------------------------------
# 2. System Dependencies & Full Build Toolchains
#    (Linux C/C++, Windows MinGW, Go, Python, RE tools)
# ------------------------------------------
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    curl \
    git \
    zip \
    unzip \
    tar \
    xz-utils \
    bzip2 \
    zstd \
    lz4 \
    lzip \
    lzop \
    unar \
    cabextract \
    squashfs-tools \
    cpio \
    e2fsprogs \
    p7zip-full \
    python3 \
    python3-pip \
    python3-venv \
    rsync \
    tshark \
    wabt \
    gdb \
    binutils \
    file \
    patchelf \
    procps \
    util-linux \
    liblz4-1 \
    liblzo2-2 \
    libfontconfig1 \
    build-essential \
    clang \
    lld \
    cmake \
    ninja-build \
    pkg-config \
    autoconf \
    automake \
    libtool \
    nasm \
    bison \
    flex \
    mingw-w64 \
    osslsigncode \
    golang-go \
    tmux \
    locales \
    && rm -rf /var/lib/apt/lists/* && \
    sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen && \
    /usr/sbin/locale-gen en_US.UTF-8

ENV LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8

ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 \
    PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=1 \
    PUPPETEER_SKIP_DOWNLOAD=1 \
    REA_BROWSER_EXECUTABLE=""

# ------------------------------------------
# 3. Adoptium Temurin JDK 21 (Full JDK)
# ------------------------------------------
RUN mkdir -p /opt/jdk-21 && \
    curl -fsSL "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.12.1%2B1/OpenJDK21U-jdk_x64_linux_hotspot_21.0.12.1_1.tar.gz" -o /tmp/jdk21.tar.gz && \
    tar -xzf /tmp/jdk21.tar.gz -C /opt/jdk-21 --strip-components=1 && \
    rm -f /tmp/jdk21.tar.gz

ENV JAVA_HOME="/opt/jdk-21"
ENV PATH="/opt/jdk-21/bin:${PATH}"

# ------------------------------------------
# 4. Android SDK (Cmdline-tools + Build-tools 34 + Platform 34) & Gradle
# ------------------------------------------
RUN mkdir -p /opt/android-sdk/cmdline-tools /opt/gradle && \
    curl -fsSL "https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip" -o /tmp/cmdline.zip && \
    unzip -q /tmp/cmdline.zip -d /opt/android-sdk/cmdline-tools && \
    mv /opt/android-sdk/cmdline-tools/cmdline-tools /opt/android-sdk/cmdline-tools/latest && \
    rm -f /tmp/cmdline.zip && \
    yes | /opt/android-sdk/cmdline-tools/latest/bin/sdkmanager --licenses >/dev/null 2>&1 && \
    /opt/android-sdk/cmdline-tools/latest/bin/sdkmanager "platforms;android-34" "build-tools;34.0.0" >/dev/null 2>&1 && \
    curl -fsSL "https://services.gradle.org/distributions/gradle-8.10.2-bin.zip" -o /tmp/gradle.zip && \
    unzip -q /tmp/gradle.zip -d /opt/gradle && \
    rm -f /tmp/gradle.zip

ENV ANDROID_HOME="/opt/android-sdk"
ENV PATH="/opt/android-sdk/cmdline-tools/latest/bin:/opt/android-sdk/platform-tools:/opt/android-sdk/build-tools/34.0.0:/opt/gradle/gradle-8.10.2/bin:${PATH}"

# ------------------------------------------
# 5. Ghidra 12.1.4 (Official Release)
# ------------------------------------------
RUN mkdir -p /opt/ghidra && \
    curl -fsSL "https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_12.1.4_build/ghidra_12.1.4_PUBLIC_20260921.zip" -o /tmp/ghidra.zip && \
    unzip -q /tmp/ghidra.zip -d /opt/ghidra && \
    chmod +x /opt/ghidra/ghidra_12.1.4_PUBLIC/support/analyzeHeadless && \
    rm -f /tmp/ghidra.zip

ENV GHIDRA_INSTALL_DIR="/opt/ghidra/ghidra_12.1.4_PUBLIC"
ENV REA_ANALYSIS_PROVIDER="ghidra"

# ------------------------------------------
# 6. Headless JADX MCP + JADX CLI + Apktool
# ------------------------------------------
RUN mkdir -p /opt/jadx /opt/jadx-cli && \
    curl -fsSL "https://github.com/1013503897/jadx-headless-mcp/releases/download/v0.7.1/jadx-headless-mcp-0.7.1-all.jar" -o /opt/jadx/jadx-headless-mcp-0.7.1-all.jar && \
    curl -fsSL "https://github.com/skylot/jadx/releases/download/v1.5.6/jadx-1.5.6.zip" -o /tmp/jadx.zip && \
    unzip -q /tmp/jadx.zip -d /opt/jadx-cli && \
    chmod +x /opt/jadx-cli/bin/jadx && \
    ln -sf /opt/jadx-cli/bin/jadx /usr/local/bin/jadx && \
    rm -f /tmp/jadx.zip && \
    curl -fsSL "https://raw.githubusercontent.com/iBotPeaches/Apktool/master/scripts/linux/apktool" -o /usr/local/bin/apktool && \
    chmod +x /usr/local/bin/apktool && \
    curl -fsSL "https://github.com/iBotPeaches/Apktool/releases/download/v3.0.3/apktool_3.0.3.jar" -o /usr/local/bin/apktool.jar

ENV REA_JADX_MCP_JAR="/opt/jadx/jadx-headless-mcp-0.7.1-all.jar"
ENV REA_APKTOOL_COMMAND="/usr/local/bin/apktool"

# ------------------------------------------
# 7. Binwalk 3.1.0 & Unblob 26.6.4 & Pwntools
# ------------------------------------------
COPY --from=binwalk-builder /install/bin/binwalk /usr/local/bin/binwalk
RUN chmod +x /usr/local/bin/binwalk && \
    pip3 install --no-cache-dir --break-system-packages unblob==26.6.4 pwntools python-telegram-bot httpx

ENV REA_BINWALK_COMMAND="/usr/local/bin/binwalk"
ENV REA_UNBLOB_COMMAND="/usr/local/bin/unblob"
ENV REA_FIRMWARE_PRLIMIT_COMMAND="/usr/bin/prlimit"
ENV REA_PWNTOOLS_PYTHON="/usr/bin/python3"

# ------------------------------------------
# 8. Hermes Agent Core & Caddy Server
# ------------------------------------------
RUN git clone --depth 1 https://github.com/NousResearch/hermes-agent.git /usr/local/lib/hermes-agent && \
    pip3 install --no-cache-dir --break-system-packages -e "/usr/local/lib/hermes-agent" && \
    curl -fsSL "https://caddyserver.com/api/download?os=linux&arch=amd64" -o /usr/local/bin/caddy && \
    chmod +x /usr/local/bin/caddy

# ------------------------------------------
# 9. code-server
# ------------------------------------------
RUN curl -fsSL https://code-server.dev/install.sh | sh

# ------------------------------------------
# 10. goFiles & opencode-router
# ------------------------------------------
RUN mkdir -p /tmp/dl /opt/opencode-router && \
    curl -fsSL "https://github.com/G-Aman/goFiles/releases/latest/download/gofiles-linux-amd64.zip" -o /tmp/dl/gf.zip && \
    unzip -q /tmp/dl/gf.zip -d /tmp/dl/gf && \
    mv /tmp/dl/gf/gofiles-linux-amd64/gofiles /usr/local/bin/gofiles && \
    chmod +x /usr/local/bin/gofiles && \
    curl -fsSL "https://github.com/G-Aman/opencode-router/releases/latest/download/opencode-router-linux-amd64.zip" -o /tmp/dl/ocr.zip && \
    unzip -q /tmp/dl/ocr.zip -d /tmp/dl/ocr && \
    cp -r /tmp/dl/ocr/opencode-router-linux-amd64/* /opt/opencode-router/ && \
    chmod +x /opt/opencode-router/opencode-router && \
    ln -sf /opt/opencode-router/opencode-router /usr/local/bin/opencode-router && \
    rm -rf /tmp/dl

# ------------------------------------------
# 11. Bun & Web Tools
# ------------------------------------------
RUN curl -fsSL "https://github.com/oven-sh/bun/releases/latest/download/bun-linux-x64.zip" -o /tmp/bun.zip && \
    unzip -q /tmp/bun.zip -d /tmp/bun && \
    mv /tmp/bun/bun-linux-x64/bun /usr/local/bin/bun && \
    chmod +x /usr/local/bin/bun && \
    rm -rf /tmp/bun*

# ------------------------------------------
# 12. CLI Agents (Claude Code, OpenCode, DeepSeek Harness, REA, Supergateway) + Browser Hard-Block
# ------------------------------------------
COPY security/stub-playwright-index.js /tmp/stub-pw.js
COPY security/stub-playwright-index.mjs /tmp/stub-pw.mjs
RUN npm config set ignore-scripts false && \
    npm config set allow-scripts true && \
    npm install -g \
      pnpm \
      yarn \
      typescript \
      supergateway@4.1.0 \
      rea-agents@latest \
      hermes-web-ui@0.7.34 \
      opencode-ai@latest \
      @anthropic-ai/claude-code@latest \
      @deepseek-ai/dsh@latest \
      --prefix /usr/local \
      --force && \
    chmod +x /usr/local/bin/* 2>/dev/null || true && \
    ln -sf /usr/local/bin/dsh /usr/local/bin/deepseek-harness 2>/dev/null || true && \
    cp /tmp/stub-pw.js /usr/local/lib/node_modules/rea-agents/node_modules/playwright-core/index.js 2>/dev/null || true && \
    cp /tmp/stub-pw.mjs /usr/local/lib/node_modules/rea-agents/node_modules/playwright-core/index.mjs 2>/dev/null || true && \
    rm -f /tmp/stub-pw.* && \
    for b in chromium chromium-browser google-chrome google-chrome-stable chrome firefox playwright playwright-core puppeteer chromedriver geckodriver msedge brave-browser webkit; do \
      printf '#!/bin/sh\necho "ERROR: Browser engines and browser automation are strictly disabled by host security policy." >&2\nexit 126\n' > "/usr/local/bin/$b" && chmod 755 "/usr/local/bin/$b"; \
    done && \
    rm -rf /root/.npm && \
    /usr/local/bin/rea setup --client opencode --client vscode --yes || true

# ------------------------------------------
# 14. Application Setup & Runtime Runner
# ------------------------------------------
WORKDIR /app
COPY config/ /app/config/
COPY services/ /app/services/
COPY entrypoint.sh /app/entrypoint.sh
RUN chmod +x /app/entrypoint.sh /app/services/*.sh && mkdir -p /data

WORKDIR /data
ENTRYPOINT ["/app/entrypoint.sh"]