version: "3"
services:
  # nosemgrep
  emba:
    image: embeddedanalyzer/emba:latest
    read_only: true
    # all pre-checker mount modules need privileged mode
    # nosemgrep
    privileged: true
    # /root/.config is needed for binwalk - further recovery for other tools needed
    # /root/.cache is needed for unblob -> further recovery of this directory needed
    # /external/arachni/... needed by arachni (full system emulator modules)
    # /external/freetz-ng/.fakeroot-cache needed by freetz-ng (AVM extractor)
    # Todo: cleanup of tmpfs entries
    tmpfs:
      - /tmp
      - /root/.config/
      - /root/.local/
      - /root/.cache/
      - /root/.cache/pypoetry/virtualenvs:exec
      - /root
      - /root/.cargo/bin:exec
      - /run/lock
      - /var
      - /var/run
      - /var/tmp
      - /var/lock
      - /var/lib/nikto:exec
      - /external/freetz-ng/.fakeroot-cache
      - /external/arachni/arachni-1.6.1.3-0.6.1.1/bin/../.system/arachni-ui-web/config/component_cache
      - /external/arachni/arachni-1.6.1.3-0.6.1.1/bin/../.system/arachni-ui-web/db
      - /external/arachni/arachni-1.6.1.3-0.6.1.1/bin/../.system/arachni-ui-web/tmp
      - /external/arachni/arachni-1.6.1.3-0.6.1.1/bin/../.system/../logs
      - /external/arachni/arachni-1.6.1.3-0.6.1.1/bin/../.system/home
    build: .
    # /dev is needed for the system emulator (L10)
    # /lib/modules is needed for modules which are loading kernel modules (e.g. extractors)
    # /boot is needed for modules which are loading kernel modules (e.g. extractors like P10)
    volumes:
        - ${FIRMWARE}/:/firmware:ro
        - ${LOG}/:/logs
        - ${EMBA}/:/emba:ro
        - ${EMBA}/external/linux_kernel_sources/:/external/linux_kernel_sources:ro
        - /etc/localtime:/etc/localtime:ro
        - /dev:/dev
        - /lib/modules:/lib/modules:ro
        - /boot:/boot:ro
    environment:
        - USER
    devices:
      - /dev/fuse:/dev/fuse:rwm
    cap_add:
      - SYS_ADMIN
    networks:
      - emba_runs
    ulimits:
      core:
        hard: 0
        soft: 0

networks:
  emba_runs:
    name: emba_runs
    driver: bridge
    internal: true
    driver_opts:
      com.docker.network.bridge.name: emba_runs
    ipam:
      config:
        - subnet: "172.36.0.0/16"