Initial public release: dockerized reverse-engineering workbench

ChipBench packages Ghidra, radare2, binwalk, chip-programming tools,
simulators, and firmware-unpacking utilities into one reproducible container
for analyzing raw chip dumps entirely from the command line or an AI CLI.
Headless Jython scripts drive import, forced-disassembly sweeps, live
queries, and bulk decompilation exports without any GUI.

Derived from a private engagement environment, generalized for public
release under AGPLv3. No engagement-specific artifacts are included.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

docker-compose.yml

@@ -0,0 +1,64 @@
+name: chipbench
+
+services:
+  ghidra:
+    container_name: chipbench-ghidra
+    build:
+      context: ./docker
+      dockerfile: Dockerfile
+      args:
+        BUILD_UID: ${HOST_UID:-1001}
+        BUILD_GID: ${HOST_GID:-1001}
+    image: chipbench:latest
+    # Run as the host-mapped uid so bind-mounted files keep their owner.
+    user: "${HOST_UID:-1001}:${HOST_GID:-1001}"
+    hostname: chipbench
+    environment:
+      - VNC_PASSWORD=${VNC_PASSWORD:-chipbench}
+      - DISPLAY=:0
+      # Quieten Java's noisy startup under a virtual framebuffer.
+      - _JAVA_OPTIONS=-Dsun.java2d.uiScale=1 -Dawt.useSystemAAFontSettings=on
+    volumes:
+      # Chip dumps land here (read-only so we can never clobber the source).
+      - ./artifacts:/data/artifacts:ro
+      # Persistent Ghidra project (.gpr + .rep) and supervisor logs.
+      - ./work:/data/work
+      # Exported decompilation / disassembly / reports.
+      - ./output:/data/output
+      # Ghidra query/export scripts — host-mounted so they can be edited
+      # without rebuilding the image.
+      - ./docker/scripts/ghidra-scripts:/opt/ghidra-scripts:ro
+    ports:
+      # 5900  -> raw VNC (any VNC viewer)
+      # 6080  -> noVNC web client (http://localhost:6080/vnc.html)
+      # 8081  -> GhidraMCP bridge (MCP over SSE)
+      - "127.0.0.1:5900:5900"
+      - "127.0.0.1:6080:6080"
+      - "127.0.0.1:8081:8081"
+    shm_size: "2g"
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "ss -ltn | grep -q ':6080' || exit 1"]
+      interval: 15s
+      timeout: 3s
+      retries: 5
+      start_period: 30s
+    # Default command boots the desktop + Ghidra + MCP bridge via supervisor.
+    command: ["supervisor"]
+
+  # One-shot helper target: never auto-starts. Used by `re-analyze`,
+  # `re-shell`, `re-binwalk`, etc. via `docker compose run --rm tools ...`.
+  tools:
+    container_name: chipbench-tools
+    profiles: ["cli"]
+    image: chipbench:latest
+    user: "${HOST_UID:-1001}:${HOST_GID:-1001}"
+    environment:
+      - DECOMPILE_OUT=/data/output
+    volumes:
+      - ./artifacts:/data/artifacts:ro
+      - ./work:/data/work
+      - ./output:/data/output
+      - ./docker/scripts/ghidra-scripts:/opt/ghidra-scripts:ro
+    entrypoint: ["/bin/bash", "-lc"]
+    command: ["echo 'chipbench tools image ready'"]