FROM ubuntu:24.04

# Forensic tools runner for Chapter 15 labs:
#   Lab 15.2 - RegRipper (Registry analysis)
#   Lab 15.4 - Volatility 3 (memory forensics)
#   Lab 15.6a - CloudTrail/S3 log triage (Python/pandas)
#   Lab 15.6c - Report drill (document output)

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update -qq && \
    apt-get install -y --no-install-recommends \
        python3 \
        python3-pip \
        python3-venv \
        git \
        curl \
        wget \
        perl \
        libparallel-forkmanager-perl \
        libparse-win32registry-perl \
        file \
        xxd \
        sha256deep \
        libssl-dev \
        libffi-dev \
        python3-dev \
        build-essential \
        ca-certificates \
        less \
        jq \
    && rm -rf /var/lib/apt/lists/*

# RegRipper: Perl-based Windows Registry parser
# Source: https://github.com/keydet89/RegRipper3.0
RUN git clone --depth=1 https://github.com/keydet89/RegRipper3.0.git /opt/regripper && \
    chmod +x /opt/regripper/rip.pl && \
    ln -s /opt/regripper/rip.pl /usr/local/bin/rip.pl

# Volatility 3: Python 3 memory forensics framework
# Source: https://github.com/volatilityfoundation/volatility3
RUN python3 -m venv /opt/venv && \
    /opt/venv/bin/pip install --no-cache-dir --upgrade pip && \
    /opt/venv/bin/pip install --no-cache-dir \
        volatility3 \
        pandas \
        matplotlib \
        notebook \
        ipykernel \
        tabulate \
        openpyxl

# Make venv python/vol.py accessible
ENV PATH="/opt/venv/bin:$PATH"

# Convenience wrapper: vol.py -> volatility3 entry point
RUN ln -s /opt/venv/bin/vol /usr/local/bin/vol.py 2>/dev/null || true

WORKDIR /labs

CMD ["/bin/bash"]
