Initial public release: dockerized reverse-engineering workbench

ChipBench packages Ghidra, radare2, binwalk, chip-programming tools,
simulators, and firmware-unpacking utilities into one reproducible container
for analyzing raw chip dumps entirely from the command line or an AI CLI.
Headless Jython scripts drive import, forced-disassembly sweeps, live
queries, and bulk decompilation exports without any GUI.

Derived from a private engagement environment, generalized for public
release under AGPLv3. No engagement-specific artifacts are included.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

docker/conf/supervisord.conf

@@ -0,0 +1,74 @@
+[supervisord]
+nodaemon=true
+user=chip
+logfile=/data/work/supervisord.log
+pidfile=/tmp/supervisord.pid
+childlogdir=/data/work
+loglevel=info
+
+; Control socket in a chip-writable location so `supervisorctl status`
+; works from inside the container (supervisord runs as non-root uid 1001).
+[unix_http_server]
+file=/tmp/supervisor.sock
+chmod=0700
+
+[rpcinterface:supervisor]
+supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
+
+[supervisorctl]
+serverurl=unix:///tmp/supervisor.sock
+
+[program:xvfb]
+command=/usr/bin/Xvfb :0 -screen 0 1920x1080x24 -ac +extension RANDR
+autorestart=true
+priority=10
+stdout_logfile=/data/work/xvfb.log
+stderr_logfile=/data/work/xvfb.err
+
+[program:fluxbox]
+command=/usr/bin/fluxbox
+environment=DISPLAY=":0",HOME="/home/chip"
+autorestart=true
+priority=20
+stdout_logfile=/data/work/fluxbox.log
+stderr_logfile=/data/work/fluxbox.err
+
+[program:x11vnc]
+command=/usr/bin/x11vnc -display :0 -forever -shared -noxdamage -rfbauth /home/chip/.vnc/passwd -rfbport 5900
+autorestart=true
+priority=30
+stdout_logfile=/data/work/x11vnc.log
+stderr_logfile=/data/work/x11vnc.err
+
+[program:novnc]
+command=/usr/bin/websockify --web /usr/share/novnc/ 6080 localhost:5900
+autorestart=true
+priority=40
+stdout_logfile=/data/work/novnc.log
+stderr_logfile=/data/work/novnc.err
+
+[program:ghidra]
+; GUI project manager. Open the chip dump from here; the GhidraMCP plugin
+; starts its REST server on 127.0.0.1:8080 once the CodeBrowser tool loads.
+; NOTE: the `ghidraRun` wrapper hardcodes launch.sh "bg" mode, which daemonizes
+; the JVM and exits 0 -- supervisor would then respawn it forever. So we call
+; launch.sh "fg" directly so the JVM runs in the foreground and is tracked.
+; We first wait for the X server to avoid an AWT connect race.
+command=bash -c 'for i in {1..60}; do [ -e /tmp/.X11-unix/X0 ] && break; sleep 0.5; done; exec /opt/ghidra/support/launch.sh fg jdk Ghidra "" "" ghidra.GhidraRun'
+directory=/data/work
+environment=DISPLAY=":0",HOME="/home/chip"
+autorestart=true
+startsecs=10
+startretries=3
+priority=50
+stdout_logfile=/data/work/ghidra.log
+stderr_logfile=/data/work/ghidra.err
+
+[program:mcp-bridge]
+; MCP-over-SSE bridge to the GhidraMCP REST API (reachable from host on 8081).
+command=/opt/venv/bin/python /opt/ghidramcp/bridge_mcp_ghidra.py --transport sse --mcp-host 0.0.0.0 --mcp-port 8081 --ghidra-server http://127.0.0.1:8080/
+autorestart=true
+startsecs=3
+priority=60
+stdout_logfile=/data/work/mcp-bridge.log
+stderr_logfile=/data/work/mcp-bridge.err