# ── Pentest Code sandbox image ───────────────────────────────────────────
# A disposable Kali-based container in which ALL agent commands execute.
# Nothing the agent runs ever touches your host. Rebuild with:
#   docker build -t pentest-code-sandbox:latest .
FROM kalilinux/kali-rolling:latest

ENV DEBIAN_FRONTEND=noninteractive \
    LANG=C.UTF-8 \
    PENTESTCODE_IN_SANDBOX=1

# Core CLI + a pragmatic set of pentest tools from the Kali repos.
# Metasploit / heavy frameworks are intentionally left to `kali-linux-large`
# (see the commented line) to keep the base image lean.
RUN apt-get update && apt-get install -y --no-install-recommends \
        bash coreutils procps iproute2 iputils-ping net-tools \
        curl wget git vim nano less jq unzip ca-certificates \
        python3 python3-pip python3-venv \
        nmap masscan \
        dnsutils whatweb nikto gobuster dirb ffuf \
        sqlmap wpscan \
        hydra john hashcat \
        netcat-traditional socat tcpdump \
        seclists wordlists openssh-client \
    && rm -rf /var/lib/apt/lists/*

# Uncomment for the full Kali toolset (large image, ~10GB):
# RUN apt-get update && apt-get install -y kali-linux-large && rm -rf /var/lib/apt/lists/*

# Handy Python offensive libraries.
RUN pip3 install --no-cache-dir --break-system-packages \
        requests impacket pwntools scapy dnspython 2>/dev/null || \
    pip3 install --no-cache-dir \
        requests impacket pwntools scapy dnspython

# Decompress the seclists/rockyou wordlist if present.
RUN [ -f /usr/share/wordlists/rockyou.txt.gz ] && gunzip -f /usr/share/wordlists/rockyou.txt.gz || true

WORKDIR /root/engagement

# Keep the container alive so the agent can exec into it repeatedly.
CMD ["sleep", "infinity"]
