WebGoat/Dockerfile_desktop at main · fgibelin/WebGoat · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
# Builder stage to download OWASP ZAP once per version
FROM alpine:3.24.3 AS zap
ARG ZAP_VERSION=2.17.0
RUN apk add --no-cache curl tar \
  && set -eux; \
     curl -sSL "https://github.com/zaproxy/zaproxy/releases/download/v${ZAP_VERSION}/ZAP_${ZAP_VERSION}_Linux.tar.gz" -o /tmp/zap.tgz; \
     mkdir -p /zap; \
     tar -xzf /tmp/zap.tgz -C /zap --strip-components=1; \
     rm -f /tmp/zap.tgz

# Builder stage to fetch a JRE suited for the target architecture
FROM alpine:3.24.3 AS jre
ARG JAVA_MAJOR=25
ARG JAVA_FULL=25.0.3.0
ARG TARGETARCH
RUN apk add --no-cache curl tar \
  && set -eux; \
     case "${TARGETARCH}" in \
       amd64) ARCH=x64 ;; \
       arm64) ARCH=aarch64 ;; \
       *) echo "Unsupported architecture: ${TARGETARCH}" >&2; exit 1 ;; \
     esac; \
     JAVA_ENC="${JAVA_FULL//+/%2B}"; \
     JAVA_FILE="${JAVA_FULL//+/_}"; \
     curl -sSL "https://github.com/AdoptOpenJDK/semeru${JAVA_MAJOR}-binaries/releases/download/jdk-${JAVA_ENC}/ibm-semeru-open-jre_${ARCH}_linux_${JAVA_ENC}.tar.gz" -o /tmp/java.tgz; \
     mkdir -p /jre; \
     tar -xzf /tmp/java.tgz -C /jre --strip-components=1; \
     rm -f /tmp/java.tgz

# Final runtime image
FROM lscr.io/linuxserver/webtop:ubuntu-kde
LABEL name="WebGoat: A deliberately insecure Web Application"
LABEL maintainer="WebGoat team"

ARG ZAP_VERSION=2.17.0
ENV ZAP_VERSION=${ZAP_VERSION} \
    JAVA_HOME=/config/java-jdk \
    PATH="${PATH}:/config/java-jdk/bin" \
    ZAP_HOME=/config/zap \
    ZAP_PROXY_PORT=8090

WORKDIR /config

# Install Firefox, editors, and gzip support
RUN apt-get update \
  && apt-get --yes install --no-install-recommends ca-certificates curl gnupg vim nano gzip \
  && install -d -m 0755 /etc/apt/keyrings \
  && curl -fsSL https://packages.mozilla.org/apt/repo-signing-key.gpg -o /etc/apt/keyrings/packages.mozilla.org.asc \
  && test "$(gpg --show-keys --with-colons /etc/apt/keyrings/packages.mozilla.org.asc | awk -F: '$1 == "fpr" { print $10; exit }')" = "35BAA0B33E9EB396F59CA838C0BA5CE6DC6315A3" \
  && echo "deb [signed-by=/etc/apt/keyrings/packages.mozilla.org.asc] https://packages.mozilla.org/apt mozilla main" > /etc/apt/sources.list.d/mozilla.list \
  && printf '%s\n' 'Package: *' 'Pin: origin packages.mozilla.org' 'Pin-Priority: 1000' '' 'Package: firefox' 'Pin: release o=Ubuntu' 'Pin-Priority: -1' > /etc/apt/preferences.d/mozilla \
  && apt-get update \
  && apt-get --yes install --no-install-recommends firefox \
  && rm -rf /var/lib/apt/lists/*

# Application artifacts
COPY target/webgoat-*.jar /config/webgoat.jar
COPY config/desktop/start_webgoat.sh /config/start_webgoat.sh
COPY config/desktop/start_zap.sh /config/start_zap.sh
COPY config/desktop/WebGoat.txt /config/Desktop/
COPY config/desktop/firefox-policies.json /usr/lib/firefox/distribution/policies.json

# Runtime dependencies produced in the builder stages
COPY --from=zap /zap ${ZAP_HOME}
COPY --from=jre /jre ${JAVA_HOME}

RUN chmod +x /config/start_webgoat.sh /config/start_zap.sh

WORKDIR /config/Desktop