FROM ubuntu:26.10@sha256:93e29beff5257b2cdf1c024d831f6d2997e53655a653ff76a811fc9e6564a719

ADD --chmod=0755 --checksum=sha256:c125df9762b0c7233459087bb840c0e5dbfc4d9690ee227f1ed8994f4d51d2e0 \
    https://raw.githubusercontent.com/reproducible-containers/repro-sources-list.sh/v0.1.4/repro-sources-list.sh \
    /usr/local/bin/repro-sources-list.sh

RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \
    /usr/local/bin/repro-sources-list.sh && \
    apt-get update && \
    DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends --yes \
        ca-certificates \
        qemu-system-x86 \
        wget \
        xxd \
    && \
    rm -f /usr/local/bin/repro-sources-list.sh

RUN useradd --create-home --shell /bin/bash ctf

COPY ynetd /sbin/
COPY nuclear run.sh flag.txt /home/ctf/

WORKDIR /home/ctf
RUN prepare=1 ./run.sh # Patch the ISO only

RUN chmod 555 /home/ctf && \
    chown -R root:root /home/ctf && \
    chmod -R 000 /home/ctf/* && \
    chmod 500 /sbin/ynetd && \
    chmod 004 /home/ctf/flag.txt && \
    chmod 004 /home/ctf/*.iso && \
    chmod 005 /home/ctf/nuclear && \
    chmod 005 /home/ctf/run.sh

RUN rm -rf /etc/systemd/system-generators/systemd-gpt-auto-generator /var/lib/pebble/default

RUN find / -ignore_readdir_race -type f \( -perm -4000 -o -perm -2000 \) -delete
USER ctf
RUN ! find / -writable -or -user $(id -un) -or -group $(id -Gn|sed -e 's/ / -or -group /g') 2> /dev/null | grep -Ev -m 1 '^(/dev/|/run/|/proc/|/sys/|/tmp|/var/tmp|/var/lock)'
USER root

WORKDIR /home/ctf
EXPOSE 1024
CMD while true; do sleep 1m; find /tmp -name 'tmp.*' -mmin '+15' -exec rm -rf {} +; done & \
    ynetd -t 600 -lt 300 -lm -1 /home/ctf/run.sh
