mrcharles
1b447b77ad
ChipBench packages Ghidra, radare2, binwalk, chip-programming tools,
simulators, and firmware-unpacking utilities into one reproducible container
for analyzing raw chip dumps entirely from the command line or an AI CLI.
Headless Jython scripts drive import, forced-disassembly sweeps, live
queries, and bulk decompilation exports without any GUI.
Derived from a private engagement environment, generalized for public
release under AGPLv3. No engagement-specific artifacts are included.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
65 lines
2.2 KiB
YAML
65 lines
2.2 KiB
YAML
name: chipbench
|
|
|
|
services:
|
|
ghidra:
|
|
container_name: chipbench-ghidra
|
|
build:
|
|
context: ./docker
|
|
dockerfile: Dockerfile
|
|
args:
|
|
BUILD_UID: ${HOST_UID:-1001}
|
|
BUILD_GID: ${HOST_GID:-1001}
|
|
image: chipbench:latest
|
|
# Run as the host-mapped uid so bind-mounted files keep their owner.
|
|
user: "${HOST_UID:-1001}:${HOST_GID:-1001}"
|
|
hostname: chipbench
|
|
environment:
|
|
- VNC_PASSWORD=${VNC_PASSWORD:-chipbench}
|
|
- DISPLAY=:0
|
|
# Quieten Java's noisy startup under a virtual framebuffer.
|
|
- _JAVA_OPTIONS=-Dsun.java2d.uiScale=1 -Dawt.useSystemAAFontSettings=on
|
|
volumes:
|
|
# Chip dumps land here (read-only so we can never clobber the source).
|
|
- ./artifacts:/data/artifacts:ro
|
|
# Persistent Ghidra project (.gpr + .rep) and supervisor logs.
|
|
- ./work:/data/work
|
|
# Exported decompilation / disassembly / reports.
|
|
- ./output:/data/output
|
|
# Ghidra query/export scripts — host-mounted so they can be edited
|
|
# without rebuilding the image.
|
|
- ./docker/scripts/ghidra-scripts:/opt/ghidra-scripts:ro
|
|
ports:
|
|
# 5900 -> raw VNC (any VNC viewer)
|
|
# 6080 -> noVNC web client (http://localhost:6080/vnc.html)
|
|
# 8081 -> GhidraMCP bridge (MCP over SSE)
|
|
- "127.0.0.1:5900:5900"
|
|
- "127.0.0.1:6080:6080"
|
|
- "127.0.0.1:8081:8081"
|
|
shm_size: "2g"
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "ss -ltn | grep -q ':6080' || exit 1"]
|
|
interval: 15s
|
|
timeout: 3s
|
|
retries: 5
|
|
start_period: 30s
|
|
# Default command boots the desktop + Ghidra + MCP bridge via supervisor.
|
|
command: ["supervisor"]
|
|
|
|
# One-shot helper target: never auto-starts. Used by `re-analyze`,
|
|
# `re-shell`, `re-binwalk`, etc. via `docker compose run --rm tools ...`.
|
|
tools:
|
|
container_name: chipbench-tools
|
|
profiles: ["cli"]
|
|
image: chipbench:latest
|
|
user: "${HOST_UID:-1001}:${HOST_GID:-1001}"
|
|
environment:
|
|
- DECOMPILE_OUT=/data/output
|
|
volumes:
|
|
- ./artifacts:/data/artifacts:ro
|
|
- ./work:/data/work
|
|
- ./output:/data/output
|
|
- ./docker/scripts/ghidra-scripts:/opt/ghidra-scripts:ro
|
|
entrypoint: ["/bin/bash", "-lc"]
|
|
command: ["echo 'chipbench tools image ready'"]
|