Hai-Sheng Li

FROM python:3.12-slim

# Prevent interactive prompts during package installation
ENV DEBIAN_FRONTEND=noninteractive

# Install system dependencies (build tools will be removed after pip install).
# curl + ca-certificates + gnupg are needed to add the NodeSource repository
# for the JS analysis toolchain (webcrack + @nodesecure/js-x-ray).
RUN apt-get update && apt-get install -y \
    git \
    gcc \
    g++ \
    build-essential \
    libmagic1 \
    file \
    libqt5core5a \
    libqt5gui5 \
    libqt5widgets5 \
    default-jre-headless \
    curl \
    ca-certificates \
    gnupg \
    && rm -rf /var/lib/apt/lists/*

# Install Node.js 22 LTS (needed by webcrack and @nodesecure/js-x-ray). Pinning
# to 22.x because that's the active LTS — bumping to a future major is a
# deliberate Dockerfile change, not a silent upgrade on rebuild.
RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
    apt-get install -y nodejs && \
    rm -rf /var/lib/apt/lists/*

# webcrack is the deobfuscator (CLI on PATH). Pinned to 2.16.0 — released
# 2026-04-25, last verified working with our subprocess invocation. Bumping
# this is a deliberate change so a future regression in webcrack does not
# show up as a silent JSDeobfuscation behaviour shift on image rebuild.
RUN npm install -g webcrack@2.16.0

# Create application directory
WORKDIR /app

# Copy requirements and install Python dependencies
COPY requirements.txt .
RUN pip3 install --no-cache-dir -r requirements.txt

# Remove build dependencies to reduce image size. curl + gnupg are kept —
# curl is widely useful and gnupg is small. Node.js stays.
RUN apt-get remove -y gcc g++ build-essential git && \
    apt-get autoremove -y && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# Copy application code (explicit files to help debug .dockerignore issues)
COPY redb/ ./redb/
COPY start.py .
COPY scripts/ ./scripts/

# Install @nodesecure/js-x-ray locally next to its bundled Node bridge so the
# Python wrapper's `node_modules/@nodesecure/js-x-ray` existence check passes
# without any runtime configuration. Version is pinned in the package.json.
# The npm install also triggers the `postinstall: patch-package` hook which
# re-applies the local patch in scripts/patches/ — currently a one-line fix
# for a `from "repl"` → `from "module"` import in [email protected] that breaks
# on Node 22 patches above ~22.10. Drop the patch when js-x-ray ships a fix.
RUN cd /app/redb/extractors/js_extractors/scripts && npm install --omit=dev

# Set up logging path and create logs directory
ENV LOG_FILE_PATH="/app/logs/"
RUN mkdir -p /app/logs

# Environment variables for tools (snapshot-style paths)
ENV CAPA_PATH="/usr/bin/capa"
ENV DIE_PATH="/usr/bin/nfdc"
ENV GORESYM_PATH="/usr/bin/GoReSym"
ENV JADX_PATH="/opt/deploy/jadx/bin/jadx"
ENV APKTOOL_PATH="/usr/local/bin/apktool"
ENV MALCONTENT_PATH="/usr/local/bin/mal"
ENV PATH="/usr/bin:/opt/binaryninja:${PATH}"
ENV PYTHONPATH="/opt/binaryninja/python"

# Tool timeouts
ENV CAPA_TIMEOUT="300"
ENV DIE_TIMEOUT="180"
ENV MALCONTENT_TIMEOUT="300"
ENV JADX_TIMEOUT="600"
ENV BINJA_TIMEOUT="1200"
ENV DECOMPILE_EXTRACTOR_TIMEOUT="2580"

ENV MALCONTENT_FORMATS=pebin,elf,macho,apk,javascript

# JS analysis toolchain. webcrack is on PATH from the global npm install;
# js-x-ray's Python wrapper finds the bundled Node bridge at the default
# location (no env needed). Override these in .env / Nomad if you swap tools.
ENV JS_DEOBFUSCATOR_PATH="webcrack"
ENV JS_DEOBFUSCATE_TIMEOUT="60"
ENV JS_XRAY_TIMEOUT="60"

# Copy the Binary Ninja setup script
COPY scripts/setup-and-run.sh /usr/local/bin/setup-and-run.sh
RUN chmod +x /usr/local/bin/setup-and-run.sh

# Create non-root user for security
RUN useradd -m -u 1000 analyzer
RUN chown -R analyzer:analyzer /app /app/logs
USER analyzer

# Set entrypoint to setup script for Binary Ninja installation (runtime)
ENTRYPOINT ["/usr/local/bin/setup-and-run.sh"]

# Set working directory
WORKDIR /app

# Default command - supports both feature extraction and decompilation
CMD ["python3", "start.py", "--nomad-job"]