Skip to content

Commit 4225ee0

Browse files
mattaerealmattaereal
authored
Merge pull request #16 from theredguild/develop
 feat: restructure devcontainers and improve CI #16
2 parents efdebeb + acd69da commit 4225ee0

13 files changed

Lines changed: 1366 additions & 23 deletions

File tree

‎.devcontainer/auditor/Dockerfile‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
# syntax=docker/dockerfile:1.10.0
2+
# check=error=true
3+
#
4+
# AUDITOR TRG DevContainer Dockerfile
5+
# This Dockerfile creates a specialized development environment for smart contract auditing
6+
# with focused tooling, Docker-in-Docker support, and comprehensive security analysis tools.
7+
#
8+
# Key features:
9+
# - Multi-stage build for Echidna binary
10+
# - Specialized audit tools (slither, mythril, crytic-compile)
11+
# - Foundry framework for testing and interaction
12+
# - Hardhat for development workflows
13+
# - Docker-in-Docker support for containerized tools
14+
15+
# Pull latest Echidna prebuilt image from Crytic
16+
# Echidna is a fuzzing tool for Ethereum smart contracts
17+
FROM --platform=linux/amd64 ghcr.io/crytic/echidna/echidna AS echidna
18+
19+
# Base image: Debian 12 (Bookworm) with VS Code DevContainer support
20+
# This provides a stable, development-focused base for auditing work
21+
FROM mcr.microsoft.com/vscode/devcontainers/base:bookworm
22+
23+
# Switch to root user temporarily for system package installation
24+
USER root
25+
26+
# Install essential system packages for development
27+
# These are the minimal packages needed for Web3 development tools
28+
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
29+
bash-completion # Shell completion support \
30+
build-essential # Compilation tools (gcc, make, etc.) \
31+
curl # HTTP client for downloading tools \
32+
git # Version control system \
33+
jq # JSON processor for tool outputs \
34+
pkg-config # Package configuration helper \
35+
sudo # Privilege escalation (needed for some tools) \
36+
unzip # Archive extraction \
37+
vim # Text editor \
38+
wget # Alternative HTTP client \
39+
zsh # Advanced shell \
40+
&& rm -rf /var/lib/apt/lists/*
41+
42+
43+
44+
# Install Python development dependencies
45+
# Required for Python-based security tools and package management
46+
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
47+
python3-pip # Python package installer \
48+
libpython3-dev # Python development headers \
49+
python3-dev # Python development tools \
50+
python3-venv # Python virtual environment support \
51+
&& rm -rf /var/lib/apt/lists/*
52+
53+
# Switch to vscode user for security (drop privileges)
54+
# This ensures all subsequent operations run as non-root user
55+
USER vscode
56+
WORKDIR /home/vscode
57+
ENV HOME=/home/vscode
58+
59+
# Install uv
60+
RUN curl -LsSf https://astral.sh/uv/install.sh | sh
61+
62+
# Update PATH environment for tool access
63+
# Configure paths for Python, Node.js, and other tools
64+
ENV UV_LOCAL_BIN=$HOME/.cargo/bin
65+
ENV USR_LOCAL_BIN=/usr/local/bin
66+
ENV LOCAL_BIN=${HOME}/.local/bin
67+
ENV PNPM_HOME=${HOME}/.local/share/pnpm
68+
ENV PATH=${PATH}:${USR_LOCAL_BIN}:${LOCAL_BIN}:${PNPM_HOME}:${UV_LOCAL_BIN}
69+
70+
# Install Python 3.12 with uv
71+
RUN uv python install 3.12
72+
73+
# Set the default shell to zsh for better development experience
74+
ENV SHELL=/usr/bin/zsh
75+
76+
# Running everything under zsh for consistency and features
77+
SHELL ["/usr/bin/zsh", "-ic"]
78+
79+
# Install Go programming language through asdf version manager
80+
# asdf provides consistent version management across different tools
81+
# Go is required for various Web3 tools and Foundry framework
82+
RUN git clone https://github.com/asdf-vm/asdf.git $HOME/.asdf --branch v0.15.0 && \
83+
echo '. $HOME/.asdf/asdf.sh' >> $HOME/.zshrc && \
84+
echo 'fpath=(${ASDF_DIR}/completions $fpath)' >> $HOME/.zshrc && \
85+
echo 'autoload -Uz compinit && compinit' >> $HOME/.zshrc && \
86+
. $HOME/.asdf/asdf.sh && \
87+
asdf plugin add golang && \
88+
asdf install golang latest && \
89+
asdf global golang latest
90+
91+
# Install Rust programming language
92+
# Required for various Web3 security tools and Foundry framework
93+
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && source $HOME/.cargo/env
94+
95+
# Switch to root user temporarily for Node.js installation
96+
USER root
97+
98+
# Install Node.js, npm, yarn, and pnpm through devcontainer features
99+
# These are essential for JavaScript/TypeScript Web3 development and Hardhat
100+
RUN curl -o- https://raw.githubusercontent.com/devcontainers/features/main/src/node/install.sh | bash
101+
RUN chown -R vscode:vscode ${HOME}/.npm
102+
103+
# Switch back to vscode user for security
104+
USER vscode
105+
106+
# Install Foundry framework for Ethereum development and testing
107+
# Foundry provides Forge (testing), Cast (interaction), and Anvil (local blockchain)
108+
# Essential for smart contract development and testing during audits
109+
RUN curl -L https://foundry.paradigm.xyz | zsh
110+
RUN foundryup
111+
112+
# Install Python-based security analysis tools for auditing
113+
# These tools provide comprehensive smart contract security analysis
114+
# Focused on core auditing tools: slither, mythril, crytic-compile
115+
RUN uv tool install slither-analyzer && \
116+
uv tool install mythril && \
117+
uv tool install crytic-compile
118+
119+
# Install Hardhat and Solhint for Ethereum development
120+
# Hardhat is a popular development environment, Solhint provides linting
121+
RUN pnpm install -g hardhat solhint
122+
123+
# Copy prebuilt Echidna binary from echidna stage to final image
124+
# This provides the prebuilt Echidna tool without rebuilding
125+
COPY --chown=vscode:vscode --from=echidna /usr/local/bin/echidna ${HOME}/.local/bin/echidna
126+
RUN chmod 755 ${HOME}/.local/bin/echidna
127+
128+
# Switch to non-root user for final setup
129+
USER vscode
130+
131+
# Set up user environment with Foundry path
132+
# Ensure Foundry tools are available in the user's shell
133+
RUN echo 'export PATH="/usr/local/foundry/bin:$PATH"' >> /home/vscode/.zshrc
134+
135+
# Switch to root for system cleanup
136+
USER root
137+
138+
# Clean up package cache and temporary files
139+
# This reduces image size and improves security
140+
RUN apt-get autoremove -y && apt-get clean -y
141+
142+
# Final switch to vscode user for development
143+
USER vscode

‎.devcontainer/auditor/devcontainer.json‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
{
2+
// For format details, see https://aka.ms/devcontainer.json.
3+
// This is the AUDITOR version of TRG's DevContainer - specialized for smart contract auditing
4+
// with Docker-in-Docker support, specialized audit extensions, and focused tooling for
5+
// comprehensive security analysis and code review.
6+
"name": "Auditor TRG's DevContainer",
7+
8+
// Build configuration - uses the local Dockerfile in this directory
9+
"build": {
10+
"dockerfile": "./Dockerfile"
11+
},
12+
13+
// Features to add to the dev container. More info: https://containers.dev/features.
14+
// Specialized features for auditing and development workflows
15+
"features": {
16+
"ghcr.io/devcontainers/features/git:1": {}, // Git version control support
17+
"ghcr.io/devcontainers/features/github-cli:1": {}, // GitHub CLI for repository management
18+
"ghcr.io/devcontainers/features/docker-in-docker:2.12.2": { // Docker-in-Docker for containerized tools
19+
"version": "latest", // Use latest stable version
20+
"enableNonRootDocker": "true" // Enable non-root Docker for security
21+
}
22+
},
23+
24+
// Configure tool-specific properties for VS Code
25+
"customizations": {
26+
"vscode": {
27+
// Specialized extensions for smart contract auditing and development
28+
"extensions": [
29+
// check out https://marketplace.visualstudio.com/items?itemName=tintinweb.ethereum-security-bundle for more information
30+
"tintinweb.ethereum-security-bundle", // includes what is listed above ^
31+
"tintinweb.vscode-ethover",
32+
"trailofbits.weaudit",
33+
"tintinweb.vscode-inline-bookmarks",
34+
"tintinweb.vscode-solidity-language",
35+
"tintinweb.graphviz-interactive-preview",
36+
"NomicFoundation.hardhat-solidity",
37+
"Olympixai.olympix",
38+
"trailofbits.contract-explorer",
39+
"tintinweb.chonky" // Chonky Agent
40+
],
41+
// VS Code settings optimized for auditing workflows
42+
"settings": {
43+
// Security settings - killswitch for automated tasks
44+
"task.autoDetect": "off", // Disable automatic task detection
45+
"task.problemMatchers.autoDetect": "off", // Disable automatic problem matchers
46+
47+
// Trust and security configuration
48+
"security.workspace.trust.enabled": false, // Trust no one by default
49+
50+
// Privacy settings - killswitch for telemetry
51+
"telemetry.telemetryLevel": "off", // Disable all telemetry collection
52+
53+
// Terminal configuration
54+
"terminal.integrated.defaultProfile.linux": "zsh", // Use zsh by default
55+
"terminal.integrated.profiles.linux": { "zsh": { "path": "/usr/bin/zsh" } }
56+
// Using bash might be more safe and stable, but zsh provides better features
57+
},
58+
}
59+
},
60+
61+
// Mount isolation configuration for security and development workflow
62+
// If you need to extract something from within the container, you can use docker cp, but use it at your own risk.
63+
// If you want to develop your devcontainer, you should comment this things, otherwise your changes inside the live container won't persist.
64+
// Disables mounting the host workspace into the container for isolation.
65+
"workspaceMount": "type=tmpfs,destination=/workspace",
66+
// Sets a workspace path entirely isolated within the container
67+
"workspaceFolder": "/workspace",
68+
69+
// Docker run arguments for security hardening and resource management
70+
"runArgs": [
71+
72+
// IPv6 security - disable IPv6 to reduce attack surface
73+
"--sysctl=net.ipv6.conf.all.disable_ipv6=1", // Disable IPv6 globally
74+
"--sysctl=net.ipv6.conf.default.disable_ipv6=1", // Disable IPv6 by default
75+
76+
// Network capability restrictions
77+
"--cap-drop=NET_RAW", // Disable raw packet access
78+
"--network=bridge", // Use bridge networking
79+
80+
// DNS configuration for security and reliability
81+
"--dns=1.1.1.1", // Primary DNS (Cloudflare)
82+
"--dns=1.0.0.1", // Secondary DNS (Cloudflare)
83+
84+
// Resource limits for container performance and security
85+
// Play a little bit with resources to prevent resource exhaustion
86+
// "--memory=512m", // Memory limit (commented out)
87+
// "--cpus=2" // CPU limit (commented out)
88+
],
89+
90+
// Writable mounts in case you want to set --read-only above.
91+
// Currently no additional mounts are configured
92+
"mounts": [
93+
]
94+
}

‎.devcontainer/hardened/Dockerfile‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
# syntax=docker/dockerfile:1.8
2+
# check=error=true
3+
#
4+
# HARDENED TRG DevContainer Dockerfile
5+
# This Dockerfile creates a security-hardened development environment for Web3 security research
6+
# with enhanced security features, capability dropping, and minimal attack surface.
7+
#
8+
# Key security features:
9+
# - Multi-stage build for Echidna binary
10+
# - Non-root user execution
11+
# - Minimal package installation
12+
# - Security-hardened toolchain
13+
# - Reduced tool set for security focus
14+
15+
## Multi-stage build for Echidna
16+
# Pull latest prebuilt Echidna binary from Crytic's official image
17+
# Echidna is a fuzzing tool for Ethereum smart contracts
18+
FROM --platform=linux/amd64 ghcr.io/crytic/echidna/echidna:latest AS echidna
19+
20+
# Base image: Latest Debian with VS Code DevContainer support
21+
# This provides a stable, security-focused base for development
22+
FROM mcr.microsoft.com/devcontainers/base:bookworm
23+
24+
# Install essential system packages for development
25+
# These are the minimal packages needed for Web3 development tools
26+
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
27+
bash-completion # Shell completion support \
28+
build-essential # Compilation tools (gcc, make, etc.) \
29+
curl # HTTP client for downloading tools \
30+
git # Version control system \
31+
jq # JSON processor for tool outputs \
32+
pkg-config # Package configuration helper \
33+
sudo # Privilege escalation (needed for some tools) \
34+
unzip # Archive extraction \
35+
vim # Text editor \
36+
wget # Alternative HTTP client \
37+
zsh # Advanced shell \
38+
&& rm -rf /var/lib/apt/lists/*
39+
40+
41+
42+
# Install Python development dependencies
43+
# Required for Python-based security tools and package management
44+
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
45+
python3-pip # Python package installer \
46+
libpython3-dev # Python development headers \
47+
python3-dev # Python development tools \
48+
python3-venv # Python virtual environment support \
49+
&& rm -rf /var/lib/apt/lists/*
50+
51+
# Switch to vscode user for security (drop privileges)
52+
# This ensures all subsequent operations run as non-root user
53+
USER vscode
54+
WORKDIR /home/vscode
55+
ENV HOME=/home/vscode
56+
57+
# Install uv
58+
RUN curl -LsSf https://astral.sh/uv/install.sh | sh
59+
60+
# Update PATH environment for tool access
61+
# Configure paths for Python, Node.js, and other tools
62+
ENV UV_LOCAL_BIN=$HOME/.cargo/bin
63+
ENV USR_LOCAL_BIN=/usr/local/bin
64+
ENV LOCAL_BIN=${HOME}/.local/bin
65+
ENV PNPM_HOME=${HOME}/.local/share/pnpm
66+
ENV PATH=${PATH}:${USR_LOCAL_BIN}:${LOCAL_BIN}:${PNPM_HOME}:${UV_LOCAL_BIN}
67+
68+
# Install Python 3.12 with uv
69+
RUN uv python install 3.12
70+
71+
# Set the default shell execution for subsequent RUN commands
72+
# Use zsh for better shell features and compatibility
73+
ENV SHELL=/usr/bin/zsh
74+
SHELL ["/bin/zsh", "-ic"]
75+
76+
# Install Rust programming language
77+
# Required for various Web3 security tools and Foundry framework
78+
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
79+
ENV PATH="$HOME/.cargo/bin:$PATH"
80+
81+
# Install Go programming language through asdf version manager
82+
# asdf provides consistent version management across different tools
83+
# Set asdf manager version for reproducibility
84+
RUN git clone https://github.com/asdf-vm/asdf.git $HOME/.asdf --branch v0.15.0 && \
85+
echo '. $HOME/.asdf/asdf.sh' >> $HOME/.zshrc && \
86+
echo 'fpath=(${ASDF_DIR}/completions $fpath)' >> $HOME/.zshrc && \
87+
echo 'autoload -Uz compinit && compinit' >> $HOME/.zshrc && \
88+
. $HOME/.asdf/asdf.sh && \
89+
asdf plugin add golang && \
90+
asdf install golang latest && \
91+
asdf global golang latest
92+
93+
# Switch to root user temporarily for Node.js installation
94+
# Some tools require root access for system-wide installation
95+
USER root
96+
97+
# Install Node.js, npm, yarn, and pnpm through devcontainer features
98+
# These are essential for JavaScript/TypeScript Web3 development
99+
RUN curl -o- https://raw.githubusercontent.com/devcontainers/features/main/src/node/install.sh | bash
100+
RUN chown -R vscode:vscode ${HOME}/.npm
101+
102+
# Switch back to vscode user for security
103+
USER vscode
104+
ENV PNPM_HOME=${HOME}/.local/share/pnpm
105+
ENV PATH=${PATH}:${PNPM_HOME}
106+
107+
# Install Foundry framework for Ethereum development
108+
# Foundry provides Forge (testing), Cast (interaction), and Anvil (local blockchain)
109+
RUN curl -fsSL https://foundry.paradigm.xyz | zsh && \
110+
echo 'export PATH="$HOME/.foundry/bin:$PATH"' >> ~/.zshrc && \
111+
export PATH="$HOME/.foundry/bin:$PATH" && \
112+
~/.foundry/bin/foundryup
113+
114+
# Install Hardhat globally for Ethereum development framework
115+
# Hardhat is a popular development environment for Ethereum
116+
RUN pnpm install hardhat -g
117+
118+
# Build and install Medusa fuzzing tool
119+
# Medusa is a fuzzing tool for smart contracts, similar to Echidna
120+
WORKDIR $HOME/medusa
121+
RUN git clone https://github.com/crytic/medusa $HOME/medusa && \
122+
export LATEST_TAG="$(git describe --tags | sed 's/-[0-9]+-gw+$//')" && \
123+
git checkout "$LATEST_TAG" && \
124+
go build -trimpath -o=$HOME/.local/bin/medusa -ldflags="-s -w" && \
125+
chmod 755 $HOME/.local/bin/medusa
126+
127+
# Return to home directory and clean up build artifacts
128+
WORKDIR $HOME
129+
RUN rm -rf medusa/
130+
131+
# Install Python-based security analysis tools (reduced set for security focus)
132+
# These tools provide essential smart contract security analysis
133+
# Focused on core tools: slither, mythril, crytic-compile, halmos, solc-select
134+
RUN uv tool install slither-analyzer && \
135+
uv tool install crytic-compile && \
136+
uv tool install slither-lsp && \
137+
uv tool install mythril && \
138+
uv tool install halmos && \
139+
uv tool install solc-select && \
140+
solc-select install 0.4.26 0.5.17 0.6.12 0.7.6 0.8.10 latest && solc-select use latest
141+
142+
# Copy Echidna binary from echidna stage to final image
143+
# This provides the prebuilt Echidna tool without rebuilding
144+
USER root
145+
COPY --from=echidna /usr/local/bin/echidna /usr/local/bin/echidna
146+
RUN chmod 755 /usr/local/bin/echidna
147+
148+
# Final setup and verification
149+
USER vscode
150+
RUN echo 'Development environment ready!' && \
151+
echo 'Tools installed:' && \
152+
ls -la $HOME/.local/bin/ || true
153+
154+
# Set working directory to workspace for development
155+
WORKDIR /workspace

0 commit comments

Comments
 (0)