fix(tools): run as non-root user and move binaries to /usr/local/bin#114
Open
monkeygold wants to merge 2 commits into
Open
fix(tools): run as non-root user and move binaries to /usr/local/bin#114monkeygold wants to merge 2 commits into
monkeygold wants to merge 2 commits into
Conversation
Add 'operator' user so the Kali tools container no longer runs as root by default. Go and Foundry binaries are installed to /usr/local/bin instead of /root/ so they remain accessible to the non-root user.
Web challenges use curl on port 80, pwn challenges use process liveness (kill -0 1), and python-based infra services use urllib. Enables depends_on condition: service_healthy for proper startup ordering.
jmagly
requested changes
Jul 26, 2026
jmagly
left a comment
jmagly
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed PR #114 at bb183694c502f8229d3c83b967b07b1c782ed0eb.
Blocking finding:
npm run tools:buildfails at the changedGOBIN=/usr/local/binlayer. The Go install for ProjectDiscovery httpx reports that/usr/local/bin/httpxalready exists and is not an object file. The earlier Python dependency layer installs an httpx console script there, so this path change creates a deterministic collision and the image cannot build.
Please stage or rename the ProjectDiscovery binary, or otherwise resolve the collision, then run the checked-off build, tools check, whoami, and representative Go-tool checks.
The compose healthcheck commit is also independent of the stated non-root scope; please split it or document and verify that scope explicitly.
Verification:
- docker compose config: pass, obsolete version warning only
- npm run tools:build: fail at Dockerfile Go-tool layer
- Public-input threat preflight: low risk
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
operatoruser so the Kali tools container no longer runs as root by default/usr/local/bin(accessible to non-root) instead of/root/go/binand/root/.foundry/bin/rootpaths fromPATHenvTest plan
npm run tools:buildsucceedsnpm run tools:checkpasses (radare2/gdb/objdump/upx + python stack + pip-audit)operatoruser:docker run --rm cybench-tools:latest whoami→operatordocker run --rm cybench-tools:latest nuclei -version