# ── Pentest Code sandbox image (minimal by design) ────────────────────────
# A small Kali base. Pentest Code installs whatever tools it needs ON DEMAND
# (apt-get from Kali's repos, or pip) and records them in the persistent
# sandbox-state file — so the image stays tiny, first run is fast, and the
# toolset grows to fit each engagement.
#
# Nothing the agent runs ever touches your host — only this container.
#   Build: docker build -t pentest-code-sandbox:latest .
FROM kalilinux/kali-rolling:latest

ENV DEBIAN_FRONTEND=noninteractive \
    LANG=C.UTF-8 \
    PENTESTCODE_IN_SANDBOX=1

# Just enough to bootstrap: a shell, package management, basic networking,
# git/curl/wget, and Python + pip. Everything else is installed on demand by
# the agent. This keeps the first build to well under a minute.
RUN apt-get update && apt-get install -y --no-install-recommends \
        bash coreutils procps iproute2 iputils-ping \
        ca-certificates curl wget git gnupg jq \
        dnsutils netcat-traditional \
        python3 python3-pip python3-venv \
    && rm -rf /var/lib/apt/lists/*

# Prefer a batteries-included image instead? Uncomment ONE and rebuild
# (these are large — the on-demand default is recommended):
# RUN apt-get update && apt-get install -y kali-linux-headless && rm -rf /var/lib/apt/lists/*
# RUN apt-get update && apt-get install -y nmap ffuf gobuster sqlmap nikto hydra seclists && rm -rf /var/lib/apt/lists/*

WORKDIR /root/engagement

# Keep the container alive so the agent can exec into it repeatedly.
CMD ["sleep", "infinity"]
