services:
  vuln-db:
    image: mysql:8.0
    container_name: cve5718-vuln-db
    environment:
      MYSQL_DATABASE: wordpress
      MYSQL_USER: wordpress
      MYSQL_PASSWORD: wordpress
      MYSQL_ROOT_PASSWORD: rootpass
    volumes:
      - vuln-db-data:/var/lib/mysql
    networks:
      - cve5718-net
    healthcheck:
      test: ["CMD-SHELL", "mysqladmin ping -h localhost -uroot -prootpass --silent"]
      interval: 10s
      timeout: 5s
      retries: 20

  patched-db:
    image: mysql:8.0
    container_name: cve5718-patched-db
    environment:
      MYSQL_DATABASE: wordpress
      MYSQL_USER: wordpress
      MYSQL_PASSWORD: wordpress
      MYSQL_ROOT_PASSWORD: rootpass
    volumes:
      - patched-db-data:/var/lib/mysql
    networks:
      - cve5718-net
    healthcheck:
      test: ["CMD-SHELL", "mysqladmin ping -h localhost -uroot -prootpass --silent"]
      interval: 10s
      timeout: 5s
      retries: 20

  vuln:
    build:
      context: .
      dockerfile: vuln/Dockerfile
      args:
        DND_VERSION: "1.3.9.6"
    container_name: cve5718-vuln
    depends_on:
      vuln-db:
        condition: service_healthy
    environment:
      WORDPRESS_DB_HOST: vuln-db:3306
      WORDPRESS_DB_NAME: wordpress
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: wordpress
      SITE_URL: "http://localhost:8081"
      DND_VERSION: "1.3.9.6"
      LAB_PROFILE: "vuln"
      ENABLE_LOCAL_RCE_PROOF: "yes"
    ports:
      - "8081:80"
    networks:
      - cve5718-net
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost/cve-2026-5718-lab/ >/dev/null || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 30

  patched:
    build:
      context: .
      dockerfile: patched/Dockerfile
      args:
        DND_VERSION: "1.3.9.7"
    container_name: cve5718-patched
    depends_on:
      patched-db:
        condition: service_healthy
    environment:
      WORDPRESS_DB_HOST: patched-db:3306
      WORDPRESS_DB_NAME: wordpress
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: wordpress
      SITE_URL: "http://localhost:8082"
      DND_VERSION: "1.3.9.7"
      LAB_PROFILE: "patched"
      ENABLE_LOCAL_RCE_PROOF: "no"
    ports:
      - "8082:80"
    networks:
      - cve5718-net
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost/cve-2026-5718-lab/ >/dev/null || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 30

volumes:
  vuln-db-data:
  patched-db-data:

networks:
  cve5718-net:
    driver: bridge