# Inner "Linux host" that runs a vulnerable runc 1.1.13 as root.
# This container IS the host whose filesystem the exploit mutates:
# runc executes inside it as root and (via the CVE) creates inodes on
# this container's own filesystem, outside any launched-container rootfs.
FROM ubuntu:22.04

ARG TARGETARCH
ARG RUNC_VERSION=1.1.13

# runc.<arch> SHA256 sums published with the v1.1.13 release.
ARG RUNC_SHA256_arm64=4b93701752f5338ed51592b38e039aef8c1a59856d1225df21eba84c2830743c
ARG RUNC_SHA256_amd64=bcfc299c1ab255e9d045ffaf2e324c0abaf58f599831a7c2c4a80b33f795de94

RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        ca-certificates curl jq busybox-static \
    && rm -rf /var/lib/apt/lists/*

# Install the exact vulnerable runc release binary for the build arch,
# verifying the published SHA256 so the pin is byte-exact.
RUN set -eux; \
    case "${TARGETARCH}" in \
        arm64) sha="${RUNC_SHA256_arm64}" ;; \
        amd64) sha="${RUNC_SHA256_amd64}" ;; \
        *) echo "unsupported arch ${TARGETARCH}" >&2; exit 1 ;; \
    esac; \
    curl -fsSL -o /usr/local/sbin/runc \
        "https://github.com/opencontainers/runc/releases/download/v${RUNC_VERSION}/runc.${TARGETARCH}"; \
    echo "${sha}  /usr/local/sbin/runc" | sha256sum -c -; \
    chmod 0755 /usr/local/sbin/runc; \
    /usr/local/sbin/runc --version

# Minimal OCI rootfs (busybox) reused by every container the attacker launches.
# This rootfs is read-only / shared and is NOT the host target of the exploit.
RUN set -eux; \
    mkdir -p /opt/oci-rootfs/bin; \
    cp /bin/busybox /opt/oci-rootfs/bin/busybox; \
    for applet in sh sleep true ls cat ln rm mkdir mv; do \
        ln -sf busybox /opt/oci-rootfs/bin/${applet}; \
    done; \
    mkdir -p /opt/oci-rootfs/proc /opt/oci-rootfs/dev /opt/oci-rootfs/share

COPY config/entrypoint.sh /usr/local/bin/entrypoint.sh
RUN chmod 0755 /usr/local/bin/entrypoint.sh

CMD ["/usr/local/bin/entrypoint.sh"]