Dockerfile

# syntax=docker/dockerfile:1
###############################################################################
# HexStrike AI — dockerized on the linuxserver.io Kali base image.
#
#   * Kali-rolling repos provide the security tooling
#   * KDE web desktop on 3000/3001 (inherited from the base image)
#   * uv builds the Python environment and runs both services
#   * hexstrike_server.py    -> HexStrike API server on :8888
#   * hexstrike_mcp_http.py  -> remote streamable-HTTP MCP on :8889
#
# The upstream sources are cloned at a pinned commit at build time (not vendored)
# so this repo stays small and easy to bump.
###############################################################################
FROM lscr.io/linuxserver/kali-linux:latest

# Upstream commit to build against. Override: --build-arg HEXSTRIKE_REF=<sha>
ARG HEXSTRIKE_REF=d689933ff579d839c676c82b231f8e98326c5f04

ENV DEBIAN_FRONTEND=noninteractive \
    UV_PROJECT_ENVIRONMENT=/app/.venv \
    UV_PYTHON_INSTALL_DIR=/opt/uv/python \
    UV_PYTHON_PREFERENCE=only-managed \
    UV_LINK_MODE=copy \
    UV_COMPILE_BYTECODE=1 \
    UV_CACHE_DIR=/tmp/uv-cache

# --------------------------------------------------------------------------
# System packages + security tooling.
# kali-linux-headless pulls a large curated arsenal; we additionally name the
# tools the HexStrike /health endpoint probes plus common web/recon utilities,
# so the health check passes even if the metapackage contents drift.
# build-essential + dev headers are needed to build angr / pwntools wheels.
# --------------------------------------------------------------------------
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        git curl wget ca-certificates \
        build-essential pkg-config libssl-dev libffi-dev \
        chromium chromium-driver \
        kali-linux-headless \
        nmap masscan dnsutils \
        gobuster feroxbuster ffuf dirb dirsearch nikto \
        sqlmap wpscan whatweb wafw00f \
        hydra john hashcat medusa evil-winrm \
        amass dnsenum dnsrecon fierce theharvester responder \
        nuclei subfinder httpx-toolkit \
        arjun paramspider hakrawler getallurls \
        netexec enum4linux-ng smbclient \
        seclists wordlists \
        binwalk foremost steghide libimage-exiftool-perl \
        radare2 gdb \
    && apt-get clean && rm -rf /var/lib/apt/lists/*

# --------------------------------------------------------------------------
# Tools that are NOT packaged in Kali apt.
#  * Go tools (katana, dalfox, waybackurls): build them, then drop the Go
#    toolchain so it does not bloat the final image.
#  * rustscan: install from its published release .deb (best-effort — the build
#    continues if the release asset layout changes).
# 'gau' is provided by the apt 'getallurls' package above.
# --------------------------------------------------------------------------
RUN apt-get update && apt-get install -y --no-install-recommends golang-go && \
    export GOBIN=/usr/local/bin GOPATH=/tmp/go GOFLAGS=-buildvcs=false && \
    go install github.com/projectdiscovery/katana/cmd/katana@latest && \
    go install github.com/hahwul/dalfox/v2@latest && \
    go install github.com/tomnomnom/waybackurls@latest && \
    apt-get purge -y golang-go && apt-get autoremove -y && \
    rm -rf /tmp/go /root/.cache/go-build && \
    apt-get clean && rm -rf /var/lib/apt/lists/*

# RustScan ships its .deb inside a zip asset (rustscan.deb.zip); unzip is
# already present via the Kali tool packages above.
RUN url="$(curl -fsSL https://api.github.com/repos/RustScan/RustScan/releases/latest \
            | grep -oE 'https://[^\"]+rustscan\.deb\.zip' | head -1)" && \
    if [ -n "${url}" ]; then \
        curl -fsSL "${url}" -o /tmp/rustscan.deb.zip && \
        unzip -o /tmp/rustscan.deb.zip -d /tmp && \
        (dpkg -i /tmp/rustscan_*.deb || (apt-get update && apt-get -f install -y)) && \
        rm -f /tmp/rustscan.deb.zip /tmp/rustscan_*.deb && \
        apt-get clean && rm -rf /var/lib/apt/lists/*; \
    else echo "rustscan: no .deb asset resolved — skipping"; fi

# --------------------------------------------------------------------------
# uv (static binaries) + a managed CPython for reproducible heavy-wheel builds.
# Made world-readable so the unprivileged 'abc' service user can exec them.
# --------------------------------------------------------------------------
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/
RUN uv python install 3.12 && chmod -R a+rX /opt/uv/python /usr/local/bin/uv /usr/local/bin/uvx

# --------------------------------------------------------------------------
# Application
# --------------------------------------------------------------------------
WORKDIR /app

# 1) upstream sources at the pinned commit
RUN git clone https://github.com/0x4m4/hexstrike-ai.git /tmp/hexstrike && \
    git -C /tmp/hexstrike checkout "${HEXSTRIKE_REF}" && \
    cp /tmp/hexstrike/hexstrike_server.py \
       /tmp/hexstrike/hexstrike_mcp.py \
       /tmp/hexstrike/hexstrike-ai-mcp.json /app/ && \
    rm -rf /tmp/hexstrike

# 2) project definition only — keeps the heavy venv layer cached across edits
#    to the wrapper/docs copied below.
COPY pyproject.toml .python-version /app/

# 3) build the venv from pyproject
RUN uv sync --no-dev

# 4) our add-ons (streamable-HTTP MCP wrapper + docs). Also alias tools whose
#    Kali binary name differs from the command HexStrike invokes: the
#    'getallurls' package ships /usr/bin/getallurls, but the server calls 'gau'.
#    Finally make /app world-readable (PUID/PGID at runtime may differ from the
#    build-time 'abc' user, so we avoid ownership coupling).
COPY hexstrike_mcp_http.py README.md /app/
RUN ln -sf /usr/bin/getallurls /usr/local/bin/gau && chmod -R a+rX /app

# --------------------------------------------------------------------------
# s6-overlay services (hexstrike-server, hexstrike-mcp) + persistence init.
# The base image's /init (s6-overlay) entrypoint is inherited unchanged so the
# web desktop keeps working; our longruns are added to the 'user' bundle.
# --------------------------------------------------------------------------
COPY root/ /

EXPOSE 3000 3001 8888 8889