FROM ubuntu:24.04

ENV DEBIAN_FRONTEND=noninteractive

# Host tooling for the dm-integrity UAF reproduction pipeline (runtime only —
# the kernel is NOT built during `docker build`; use build-kernel.sh / repro.sh):
#   1) build-kernel.sh         — download + build KASAN bzImage → /artifacts
#   2) create-image-userns.sh  — Debian guest disk + SSH keys
#   3) run.sh                  — QEMU + KASAN guest + poc.c
# Kernel under test boots only inside the VM — never run poc.c on the host.
#
# Ubuntu's debian-archive-keyring is stale vs current Debian InRelease —
# install Debian's own keyring so mmdebstrap can verify bookworm+.
RUN apt-get update && apt-get install -y --no-install-recommends \
        bc \
        bison \
        build-essential \
        ca-certificates \
        cpio \
        curl \
        dwarves \
        e2fsprogs \
        flex \
        libelf-dev \
        libssl-dev \
        mmdebstrap \
        openssh-client \
        qemu-system-x86 \
        qemu-utils \
        rsync \
        util-linux \
        xz-utils \
    && curl -fsSL -o /tmp/debian-archive-keyring.deb \
        https://deb.debian.org/debian/pool/main/d/debian-archive-keyring/debian-archive-keyring_2025.1_all.deb \
    && dpkg -i /tmp/debian-archive-keyring.deb \
    && rm -f /tmp/debian-archive-keyring.deb \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /work
COPY poc.c run.sh create-image-userns.sh repro.sh build-kernel.sh ./
RUN chmod +x run.sh create-image-userns.sh repro.sh build-kernel.sh

RUN mkdir -p /artifacts /kernel

ENV OUTPUT_DIR=/artifacts \
    KERNEL_VERSION=6.6.144 \
    VM_PORT=10051 \
    RUN_TIMEOUT_SEC=180

CMD ["./repro.sh"]
