docker-compose.hybrid.yml

# =============================================================================
# Docker Compose - Rikune (hybrid)
# =============================================================================
# Auto-generated from plugin systemDeps.
# Profile: Hybrid Docker analyzer + Windows runtime
# Backend profile: default
# Build plugins: 100 | Runtime plugins: 117
# Features: angr, binwalk, capa, die, dotnet-runtime, ghidra, goresym, graphviz, jadx, jsimplifier, manifold, restringer, retdec, rizin, static-python, upx, vol3, wabt
# Regenerate: npm run docker:generate -- --profile=hybrid
# =============================================================================

name: rikune-hybrid

services:
  analyzer:
    image: rikune-analyzer:latest
    platform: linux/amd64
    build:
      context: .
      dockerfile: docker/Dockerfile.hybrid
      args:
        ANGR_VERSION: "9.2.205"
        CAPA_RULES_VERSION: "v9.3.1"
        CAPA_VERSION: "9.3.1"
        DIE_RELEASE_CHANNEL: "3.10"
        DIE_VERSION: "3.10"
        GHIDRA_VERSION: "12.1.3"
        GORESYM_VERSION: "3.3"
        http_proxy: "${RIKUNE_BUILD_HTTP_PROXY:-}"
        HTTP_PROXY: "${RIKUNE_BUILD_HTTP_PROXY:-}"
        https_proxy: "${RIKUNE_BUILD_HTTPS_PROXY:-}"
        HTTPS_PROXY: "${RIKUNE_BUILD_HTTPS_PROXY:-}"
        ILSPYCMD_VERSION: "9.1.0.7988"
        JADX_VERSION: "1.5.1"
        NO_PROXY: "${RIKUNE_BUILD_NO_PROXY:-localhost,127.0.0.1,deb.debian.org,security.debian.org,archive.ubuntu.com,security.ubuntu.com}"
        RETDEC_VERSION: "5.0"
        RIZIN_VERSION: "0.8.2"
        UPX_VERSION: "5.1.1"
        WABT_VERSION: "1.0.39"
    container_name: rikune-analyzer
    # A root operator can replace the entrypoint/user; deployment admission is the trust boundary.
    user: "1000:1000"
    stdin_open: true
    tty: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    mem_limit: 8g
    pids_limit: 512
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=512m
    deploy:
      resources:
        limits:
          memory: 8G
          cpus: '2'
          pids: 512
        reservations:
          memory: 2G
    volumes:
      - ./samples:/samples:ro
      - "${RIKUNE_DATA_ROOT:-D:/Docker/rikune}/workspaces:/app/workspaces:rw"
      - "${RIKUNE_DATA_ROOT:-D:/Docker/rikune}/data:/app/data:rw"
      - "${RIKUNE_DATA_ROOT:-D:/Docker/rikune}/cache:/app/cache:rw"
      - "${RIKUNE_DATA_ROOT:-D:/Docker/rikune}/logs:/app/logs:rw"
      - "${RIKUNE_DATA_ROOT:-D:/Docker/rikune}/storage:/app/storage:rw"
      - "${RIKUNE_DATA_ROOT:-D:/Docker/rikune}/ghidra-projects:/ghidra-projects:rw"
      - "${RIKUNE_DATA_ROOT:-D:/Docker/rikune}/ghidra-logs:/ghidra-logs:rw"
      - type: volume
        source: root-config
        target: /app/cache/home/.rikune
    environment:
      - NODE_ENV=production
      - PYTHONUNBUFFERED=1
      - RIKUNE_DOCKER_PROFILE=hybrid
      - RIKUNE_BACKEND_PROFILE=default
      - NODE_ROLE=analyzer
      - RUNTIME_MODE=remote-sandbox
      - PLUGINS=android,android-package,android-runtime,angr,api-hash,apk-smali,apple-container,apple-objc-swift,apple-signing,batch,behavior-first,binary-diff,binary-hardening,btf,bytecode,capstone,code-analysis,compiler-codegen,container-analysis,cpp-abi-layout,crackme,cross-module,cuda-binary,culifter,debug-session,deep-unpack,die,dotnet-decompile,dotnet-managed,dotnet-reactor,dynamic,ebpf-bytecode,elf-macho,external-re-bridge,firmware,frida,ghidra,go-analysis,graphviz,gtirb,host-correlation,ios-runtime,javascript-deobfuscation,jsimplifier,jsir-cascade,jsvmp-analysis,jvm,jvm-decompile,kb-collaboration,kernel-driver-surface,lib-identify,lief,linux-binary,linux-package,linux-runtime,llvm-bitcode,macos-runtime,malware,managed-fake-c2,managed-il-xrefs,managed-sandbox,manifold,memory-forensics,metadata,miasm,ml-model,native-debug-types,native-object,observability,office-analysis,panda,pcap-analysis,pdf-analysis,pe-analysis,pe-signature,python-decompile,qbdi,qiling,radare2,remill,reporting,restringer,retdec,revng,rizin,runtime-deobfuscate,rust-binary,sbom,serialization-format,shader-ir,similarity,speakeasy,static-triage,strings,syscall-abi-surface,tee-enclave,threat-intel,triton,uefi-smm-surface,unity-managed,unpacking,upx,visualization,vm-analysis,vuln-scanner,wabt,wasm,wasm-component,wasm-runtime,windows-debug-symbols,windows-installer,windows-interface-surface,windows-runtime,wine,yara,yara-x,zig-binary
      - WORKSPACE_ROOT=/app/workspaces
      - DB_PATH=/app/data/database.db
      - CACHE_ROOT=/app/cache
      - HOME=/tmp/rikune-home
      - AUDIT_LOG_PATH=/app/logs/audit.log
      - XDG_CONFIG_HOME=/tmp/rikune-home/.config
      - XDG_CACHE_HOME=/tmp/rikune-home/.cache
      - LOG_LEVEL=info
      - SANDBOX_PYTHON_PATH=/usr/local/bin/python3
      - JADX_PATH=/opt/jadx/bin/jadx
      - ANGR_PYTHON=/opt/angr-venv/bin/python
      - APKTOOL_PATH=/usr/bin/apktool
      - DIE_PATH=/usr/bin/diec
      - ILSPYCMD_PATH=/usr/local/bin/ilspycmd
      - BINWALK_PATH=/usr/bin/binwalk
      - GHIDRA_INSTALL_DIR=/opt/ghidra
      - GORESYM_PATH=/usr/local/bin/GoReSym
      - GRAPHVIZ_DOT_PATH=/usr/bin/dot
      - JSIMPLIFIER_WORKER_PATH=/opt/rikune-backends/jsimplifier/bin/jsimplifier-worker.js
      - RIZIN_PATH=/opt/rizin/bin/rizin
      - CAPA_RULES_PATH=/opt/capa-rules
      - MANIFOLD_WORKER_PATH=/opt/rikune-backends/manifold/bin/manifold-worker.js
      - VOLATILITY3_PATH=/usr/local/bin/vol
      - VOL3_SYMBOL_PATH=/opt/vol3-symbols
      - EXIFTOOL_PATH=/usr/bin/exiftool
      - TSHARK_PATH=/usr/bin/tshark
      - OSSLSIGNCODE_PATH=/usr/bin/osslsigncode
      - RESTRINGER_PATH=/opt/rikune-backends/restringer/bin/restringer-worker.js
      - RETDEC_PATH=/opt/retdec/bin/retdec-decompiler
      - UPX_PATH=/usr/local/bin/upx
      - WABT_PATH=/opt/wabt/bin
      - GHIDRA_PROJECT_ROOT=/ghidra-projects
      - GHIDRA_LOG_ROOT=/ghidra-logs
      - CAPA_PATH=/usr/local/bin/capa
      - RETDEC_INSTALL_DIR=/opt/retdec
      - RUNTIME_HOST_AGENT_ENDPOINT=${RUNTIME_HOST_AGENT_ENDPOINT:-}
      - RUNTIME_HOST_AGENT_API_KEY=${RUNTIME_HOST_AGENT_API_KEY:-}
      - RUNTIME_API_KEY=${RUNTIME_API_KEY:-}
      - RIKUNE_ALLOW_INSECURE_RUNTIME_HTTP=${RIKUNE_ALLOW_INSECURE_RUNTIME_HTTP:-false}
      # API File Server
      - API_ENABLED=true
      - API_PORT=18080
      - API_KEY=${RIKUNE_API_KEY:?RIKUNE_API_KEY_required_when_API_ENABLED_true}
      - API_STORAGE_ROOT=/app/storage
      - API_MAX_FILE_SIZE=524288000
      - API_RETENTION_DAYS=30
    healthcheck:
      test: ["CMD", "node", "-e", "const http=require('http');const r=http.get('http://localhost:18080/api/v1/health',res=>{process.exit(res.statusCode===200?0:1)});r.on('error',()=>process.exit(1));r.setTimeout(5000,()=>process.exit(1))"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    ports:
      - "127.0.0.1:${RIKUNE_API_PORT:-18080}:18080"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    restart: unless-stopped
    labels:
      - "app=rikune"
      - "component=analyzer"
      - "security.isolation=high"

volumes:
  root-config:
    driver: local
  storage:
    driver: local