name: chipbench

services:
  ghidra:
    container_name: chipbench-ghidra
    build:
      context: ./docker
      dockerfile: Dockerfile
      args:
        BUILD_UID: ${HOST_UID:-1001}
        BUILD_GID: ${HOST_GID:-1001}
    image: chipbench:latest
    # Run as the host-mapped uid so bind-mounted files keep their owner.
    user: "${HOST_UID:-1001}:${HOST_GID:-1001}"
    hostname: chipbench
    environment:
      - VNC_PASSWORD=${VNC_PASSWORD:-chipbench}
      - DISPLAY=:0
      # Quieten Java's noisy startup under a virtual framebuffer.
      - _JAVA_OPTIONS=-Dsun.java2d.uiScale=1 -Dawt.useSystemAAFontSettings=on
    volumes:
      # Chip dumps land here (read-only so we can never clobber the source).
      - ./artifacts:/data/artifacts:ro
      # Persistent Ghidra project (.gpr + .rep) and supervisor logs.
      - ./work:/data/work
      # Exported decompilation / disassembly / reports.
      - ./output:/data/output
      # Ghidra query/export scripts — host-mounted so they can be edited
      # without rebuilding the image.
      - ./docker/scripts/ghidra-scripts:/opt/ghidra-scripts:ro
    ports:
      # 5900  -> raw VNC (any VNC viewer)
      # 6080  -> noVNC web client (http://localhost:6080/vnc.html)
      # 8081  -> GhidraMCP bridge (MCP over SSE)
      - "127.0.0.1:5900:5900"
      - "127.0.0.1:6080:6080"
      - "127.0.0.1:8081:8081"
    shm_size: "2g"
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "ss -ltn | grep -q ':6080' || exit 1"]
      interval: 15s
      timeout: 3s
      retries: 5
      start_period: 30s
    # Default command boots the desktop + Ghidra + MCP bridge via supervisor.
    command: ["supervisor"]

  # One-shot helper target: never auto-starts. Used by `re-analyze`,
  # `re-shell`, `re-binwalk`, etc. via `docker compose run --rm tools ...`.
  tools:
    container_name: chipbench-tools
    profiles: ["cli"]
    image: chipbench:latest
    user: "${HOST_UID:-1001}:${HOST_GID:-1001}"
    environment:
      - DECOMPILE_OUT=/data/output
    volumes:
      - ./artifacts:/data/artifacts:ro
      - ./work:/data/work
      - ./output:/data/output
      - ./docker/scripts/ghidra-scripts:/opt/ghidra-scripts:ro
    entrypoint: ["/bin/bash", "-lc"]
    command: ["echo 'chipbench tools image ready'"]