# Chapter 20 OT tools runner
# Base: kalilinux/kali-rolling
# Installs: tshark, pymodbus (Modbus client), zeek, suricata
#
# Zeek version: 8.1.x (book access-date-current; 8.2.0 released 12 May 2026)
# Suricata version: 7.0.x (book access-date-current; 8.0.5 released 19 May 2026)
# Both are pulled from their project APT repos for the most stable pinnable build.

FROM kalilinux/kali-rolling

ENV DEBIAN_FRONTEND=noninteractive

# Core network and capture utilities
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    curl \
    wget \
    gnupg \
    lsb-release \
    tshark \
    tcpdump \
    nmap \
    netcat-traditional \
    python3 \
    python3-pip \
    python3-venv \
    libpcap-dev \
    && rm -rf /var/lib/apt/lists/*

# Zeek (from opensuse obs repo - stable Kali/Debian build)
# Fall back to apt package if the OBS key fetch fails in sandboxed builds.
RUN curl -fsSL https://download.opensuse.org/repositories/security:zeek/Debian_12/Release.key \
      | gpg --dearmor -o /etc/apt/trusted.gpg.d/zeek.gpg \
 && echo "deb http://download.opensuse.org/repositories/security:zeek/Debian_12/ /" \
      > /etc/apt/sources.list.d/zeek.list \
 && apt-get update \
 && apt-get install -y --no-install-recommends zeek || true \
 && rm -rf /var/lib/apt/lists/*

# Suricata (OISF PPA / apt repo for Debian/Ubuntu variants)
RUN apt-get update && apt-get install -y --no-install-recommends suricata || true \
 && rm -rf /var/lib/apt/lists/*

# Python Modbus client (pymodbus 3.x)
RUN python3 -m pip install --no-cache-dir --break-system-packages pymodbus==3.7.4

# Ensure Zeek is on PATH (OBS package installs to /opt/zeek/bin)
ENV PATH="/opt/zeek/bin:${PATH}"

WORKDIR /workspace
