Initial import — ntdsextract2 Docker build context

Cargo-installs --locked from crates.io on rust:1.96-alpine3.21 with
build-base + linux-headers + gettext-dev (libesedb's bundled C tree
needs all three). Final image is ~26MB on alpine:3.21.

Dockerfile

@@ -0,0 +1,32 @@
+# tabledevil/ntdsextract2 — Jan Starke's NTDS.DIT forensic analyser, Rust.
+#
+# Modern replacement for the old Python ntdsxtract; pulls users/groups/
+# computers from an offline NTDS.DIT (and the matching SYSTEM hive for
+# secret-decryption), emits a bodyfile timeline, walks the AD DIT tree.
+#
+# Upstream moved off GitHub to https://codeberg.org/janstarke/ntdsextract2
+# (still on crates.io; we install from there to keep the build hermetic).
+#
+#   docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
+#       user /data/ntds.dit
+#   docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
+#       timeline /data/ntds.dit --bodyfile > /tmp/timeline.body
+
+FROM rust:1.96-alpine3.21 AS build
+# build-base brings gcc + libc-dev + binutils + make (libesedb's bundled C
+# tree fails to compile without them); linux-headers + gettext-dev are
+# libyal-on-musl prerequisites (bindtextdomain etc.).
+RUN apk add --no-cache --virtual .build build-base clang pkgconf linux-headers gettext-dev
+
+# Crates.io build pulls upstream + embedded C code; takes ~5 min cold.
+# --locked uses the upstream Cargo.lock (otherwise resolved transitive deps
+# can demand newer rustc than the base image ships).
+RUN cargo install --locked --root /opt/ntdsextract2 ntdsextract2
+
+FROM alpine:3.21
+RUN apk add --no-cache libgcc
+COPY --from=build /opt/ntdsextract2/bin/ntdsextract2 /usr/local/bin/ntdsextract2
+COPY start.sh /start.sh
+RUN chmod +x /start.sh && mkdir -p /data
+WORKDIR /data
+ENTRYPOINT ["/start.sh"]