services:
  vulnerable:
    build:
      context: ./vulnerable
      dockerfile: Dockerfile
    image: pack2theroot-lab/vulnerable:latest
    container_name: pack2theroot-vuln
    hostname: pack2theroot-vuln
    tty: true
    stdin_open: true
    cap_add:
      - SYS_ADMIN
    security_opt:
      - apparmor:unconfined
    ports:
      - "2222:22"          # ssh labuser@localhost -p 2222  (pw: labuser)
    volumes:
      - ./scripts:/opt/lab:ro
    command: ["/opt/lab-entrypoint.sh"]

  patched:
    build:
      context: ./patched
      dockerfile: Dockerfile
    image: pack2theroot-lab/patched:latest
    container_name: pack2theroot-patched
    hostname: pack2theroot-patched
    tty: true
    stdin_open: true
    cap_add:
      - SYS_ADMIN
    security_opt:
      - apparmor:unconfined
    ports:
      - "2223:22"          # ssh labuser@localhost -p 2223  (pw: labuser)
    volumes:
      - ./scripts:/opt/lab:ro
    command: ["/opt/lab-entrypoint.sh"]

  exploit:
    build:
      context: ./exploit
      dockerfile: Dockerfile
    image: pack2theroot-lab/exploit:latest
    container_name: pack2theroot-exploit
    hostname: pack2theroot-exploit
    tty: true
    stdin_open: true
    privileged: true       # required for dbus + polkitd + packagekitd stack
    command: ["--auto"]    # runs the TOCTOU exploit automatically; remove for manual