# CTF Red Team / Blue Team Lab Environment
# Browser-accessible XFCE desktop via noVNC, with all lab tools and materials baked in.
# Build: docker compose build
# Run:   docker compose up -d
# Open:  http://127.0.0.1:6080/vnc.html
#
# The running container has NO outbound network (see docker-compose.yml `internal: true`).
# The only way in or out is the noVNC websocket on 127.0.0.1:6080.

FROM accetto/ubuntu-vnc-xfce-g3:latest

LABEL org.opencontainers.image.title="CTF Red+Blue Team Lab Environment"
LABEL org.opencontainers.image.description="Isolated XFCE/noVNC desktop with tooling and materials for the CTF Red Team and CTF Blue Team courses."

USER root

# ---------------------------------------------------------------------------
# System packages — everything the lab guides mention for cross-checking
# ---------------------------------------------------------------------------
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
      # Editors / viewers
      vim nano mousepad less tree \
      # Core shell utilities
      jq curl wget ca-certificates git unzip zip xz-utils \
      # Binary / forensics tools
      file binutils xxd hexedit radare2 yara \
      # Network inspection (offline use only — container has no network at runtime)
      whois dnsutils iproute2 net-tools tcpdump \
      # Crypto helpers
      openssl \
      # Python toolchain
      python3 python3-pip python3-venv python3-dev \
      # Misc
      hashid yamllint \
    && rm -rf /var/lib/apt/lists/*

# ---------------------------------------------------------------------------
# Python libraries used in the labs (pwntools, scapy, pycryptodome, etc.)
# --break-system-packages is required on newer Debian/Ubuntu PEP 668 layouts.
# ---------------------------------------------------------------------------
RUN pip3 install --no-cache-dir --break-system-packages \
      pwntools \
      scapy \
      requests \
      pycryptodome \
      pyyaml \
      python-magic \
      volatility3 \
      sigma-cli \
    || pip3 install --no-cache-dir \
      pwntools \
      scapy \
      requests \
      pycryptodome \
      pyyaml \
      python-magic \
      volatility3 \
      sigma-cli

# ---------------------------------------------------------------------------
# Lab materials
# Contains both courses (HTML guides + resources + shared css/js) so the
# student has everything offline inside the sandbox.
# ---------------------------------------------------------------------------
COPY labs/ /home/headless/labs/

# Drop a quick-start note on the desktop
RUN mkdir -p /home/headless/Desktop && \
    printf '%s\n' \
      '# Welcome to the CTF Lab Environment' \
      '' \
      'Everything you need lives in ~/labs/' \
      '' \
      '  ~/labs/ctf-redteam/   — Red Team course (10 lessons)' \
      '  ~/labs/ctf-blueteam/  — Blue Team course (10 lessons)' \
      '' \
      'For each lesson, open the `lab_guide.html` file in the XFCE file' \
      'manager (Thunar) — it will open in a local browser. Then open the' \
      '`resources/` folder next to it for the data files the exercises use.' \
      '' \
      '## Clipboard / AI workflow' \
      '' \
      'This container has NO network access. You run Claude (or any AI)' \
      'on your HOST machine. Workflow:' \
      '' \
      '  1. Inside this desktop, open a lab resource file, select text.' \
      '  2. Use the noVNC sidebar (left arrow) → Clipboard panel to copy.' \
      '  3. Paste into your local Claude / ChatGPT on the host.' \
      '  4. Copy the AI response back via the same Clipboard panel.' \
      '' \
      '## Tools available offline' \
      '' \
      '  python3, pwntools, scapy, pycryptodome, volatility3, sigma-cli,' \
      '  yara, radare2, jq, xxd, hashid, openssl, file, strings, tree, ...' \
      '' \
      'Happy hacking (and defending).' \
      > /home/headless/Desktop/README.txt && \
    chown -R headless:headless /home/headless/labs /home/headless/Desktop

USER headless
WORKDIR /home/headless

# Default VNC password — change via VNC_PW env var in docker-compose.yml.
ENV VNC_PW=ctflab

# Expose only the noVNC websocket port. The VNC TCP port 5901 is intentionally
# NOT exposed and is only reachable inside the container by websockify.
EXPOSE 6080
