Autumn-27
37bb386f97
- Dockerfile.bench / docker-compose.bench.yml:tsecbench 测评镜像与编排 - bench/entrypoint.sh、seed.sh:容器入口与任务种子脚本 - bench/prompts/*:测评用 planner/worker/challenge 提示词 - bench/.env.example、kali_tools.txt:配置模板与工具清单(真实 .env 仍被忽略)
99 lines
4.8 KiB
Docker
99 lines
4.8 KiB
Docker
# syntax=docker/dockerfile:1
|
||
#
|
||
# ARTEX 腾讯 TSec Benchmark 测评镜像（自包含单容器）。
|
||
# - 基于 kalilinux/kali-rolling，自带 PostgreSQL、渗透/逆向/pwn 工具、python/node/chromium
|
||
# - 二进制从【当前工作树】编译（含 platform_tools.go / orchestration.go / submit_flag 等 benchmark 代码），
|
||
# 不内嵌前端（-tags 不带 embedui，纯 API），零 Go 改动
|
||
# - 启动后 entrypoint 起库 + 起 artex + 通过 REST API 一键 seed 全部配置（提示词/自定义工具/
|
||
# 自定义 agent/触发器/LLM），密钥全部从运行时环境变量注入
|
||
#
|
||
# 构建: docker build -f Dockerfile.bench -t artex-bench:latest .
|
||
# 导出: docker save artex-bench:latest | gzip > agent.tar.gz # ≤3GB
|
||
# 本地跑: docker run --rm -p 8787:8787 \
|
||
# -e BENCHMARK_BASE_URL=... -e BENCHMARK_TOKEN=... \
|
||
# -e LLM_BASE_URL=... -e LLM_API_KEY=... artex-bench:latest
|
||
|
||
# ---------- 1) 构建前端静态导出（Next.js） ----------
|
||
FROM node:20-bookworm AS frontend
|
||
WORKDIR /web
|
||
COPY web/package.json web/package-lock.json ./
|
||
RUN npm ci
|
||
COPY web/ ./
|
||
RUN npm run build:static # 产出 /web/out
|
||
|
||
# ---------- 2) 编译 artex（内嵌前端，从当前工作树） ----------
|
||
FROM golang:1.26-bookworm AS build
|
||
WORKDIR /src
|
||
# nuclei（最新版，静态编译；@latest 与本模块无关，先装以便缓存）
|
||
RUN CGO_ENABLED=0 go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
|
||
# chisel（TCP/UDP over HTTP 隧道，用于内网转发/pivoting；最新版静态编译）
|
||
RUN CGO_ENABLED=0 go install github.com/jpillora/chisel@latest
|
||
COPY go.mod go.sum ./
|
||
RUN go mod download
|
||
COPY . .
|
||
# 前端静态产物放到 embed 目录，-tags embedui 才会内嵌 UI（本地可看界面）
|
||
COPY --from=frontend /web/out ./server/webui/dist
|
||
RUN CGO_ENABLED=0 go build -trimpath -tags embedui -o /artex ./cmd/artex
|
||
|
||
# ---------- 2) Kali 运行时 ----------
|
||
FROM kalilinux/kali-rolling
|
||
ENV DEBIAN_FRONTEND=noninteractive
|
||
|
||
# Web / 渗透 / recon + 运行时 + DB
|
||
# 去掉 metasploit-framework(~1.5-2GB) 与 seclists(~1GB+)；改用 dirb 的小字典
|
||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||
ca-certificates curl wget vim unzip jq ripgrep procps sudo \
|
||
postgresql postgresql-contrib \
|
||
python3 python3-pip python3-zombie-telnetlib nodejs npm \
|
||
nmap masscan ffuf sqlmap nikto hydra john \
|
||
ncat socat netcat-traditional inetutils-telnet dirb dnsutils proxychains4 \
|
||
python3-impacket impacket-scripts netexec evil-winrm \
|
||
&& apt-get clean && rm -rf /var/lib/apt/lists/*
|
||
|
||
# 逆向 / pwn / 二进制 / 内存（radare2 已够，去掉冗余的 rizin）
|
||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||
gdb radare2 binutils file bsdmainutils binwalk \
|
||
ltrace strace patchelf upx-ucl checksec qemu-user-static ruby \
|
||
&& apt-get clean && rm -rf /var/lib/apt/lists/*
|
||
|
||
# gef（gdb 增强，单文件，不需要 git）
|
||
RUN curl -fsSL https://gef.blah.cat/sh -o /tmp/gef.sh && bash /tmp/gef.sh && rm -f /tmp/gef.sh || true
|
||
|
||
# pwn / 逆向 python 生态 + one_gadget
|
||
RUN pip3 install --break-system-packages --no-cache-dir \
|
||
pwntools ROPgadget ropper capstone unicorn keystone-engine z3-solver \
|
||
&& gem install --no-document one_gadget || true
|
||
|
||
# nuclei（最新版二进制）+ 官方 POC 库（离线预置到 /opt/nuclei-templates；运行时用 -duc 禁联网更新）
|
||
COPY --from=build /go/bin/nuclei /usr/local/bin/nuclei
|
||
COPY --from=build /go/bin/chisel /usr/local/bin/chisel
|
||
RUN curl -sSL https://github.com/projectdiscovery/nuclei-templates/archive/refs/heads/main.tar.gz \
|
||
| tar xz -C /opt \
|
||
&& mv /opt/nuclei-templates-main /opt/nuclei-templates \
|
||
&& mkdir -p /root/.config/nuclei \
|
||
&& printf 'disable-update-check: true\n' > /root/.config/nuclei/config.yaml \
|
||
&& ln -sf /opt/nuclei-templates /root/nuclei-templates \
|
||
&& nuclei -version 2>/dev/null || true
|
||
|
||
# Awesome-POC 漏洞知识库（Threekiii，markdown POC/利用 writeup 集，离线参考，用 rg/grep 查阅）
|
||
RUN (curl -fsSL https://github.com/Threekiii/Awesome-POC/archive/refs/heads/master.tar.gz) \
|
||
| tar xz -C /opt \
|
||
&& mv /opt/Awesome-POC-* /opt/awesome-poc
|
||
|
||
# 另一离线 POC 仓库（eeeeeeeeee-code/POC，大量 CVE/组件 POC 脚本，离线参考）
|
||
RUN (curl -fsSL https://github.com/eeeeeeeeee-code/POC/archive/refs/heads/main.tar.gz \
|
||
|| curl -fsSL https://github.com/eeeeeeeeee-code/POC/archive/refs/heads/master.tar.gz) \
|
||
| tar xz -C /opt \
|
||
&& mv /opt/POC-* /opt/eee-poc
|
||
|
||
WORKDIR /app
|
||
COPY --from=build /artex /app/artex
|
||
COPY skills/ /app/skills/
|
||
COPY bench/ /app/bench/
|
||
RUN chmod +x /app/artex /app/bench/entrypoint.sh /app/bench/seed.sh
|
||
|
||
# data/（jwt.key 等）持久化点；8787=API，8788=流量代理
|
||
VOLUME ["/app/data"]
|
||
EXPOSE 8787 8788
|
||
ENTRYPOINT ["/app/bench/entrypoint.sh"]
|