# tabledevil/ntdsextract2 — Jan Starke's NTDS.DIT forensic analyser, Rust.
#
# Modern replacement for the old Python ntdsxtract; pulls users/groups/
# computers from an offline NTDS.DIT (and the matching SYSTEM hive for
# secret-decryption), emits a bodyfile timeline, walks the AD DIT tree.
#
# Upstream moved off GitHub to https://codeberg.org/janstarke/ntdsextract2
# (still on crates.io; we install from there to keep the build hermetic).
#
#   docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
#       user /data/ntds.dit
#   docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
#       timeline /data/ntds.dit --bodyfile > /tmp/timeline.body

FROM rust:1.96-alpine3.21 AS build
# build-base brings gcc + libc-dev + binutils + make (libesedb's bundled C
# tree fails to compile without them); linux-headers + gettext-dev are
# libyal-on-musl prerequisites (bindtextdomain etc.).
RUN apk add --no-cache --virtual .build build-base clang pkgconf linux-headers gettext-dev

# Crates.io build pulls upstream + embedded C code; takes ~5 min cold.
# --locked uses the upstream Cargo.lock (otherwise resolved transitive deps
# can demand newer rustc than the base image ships).
RUN cargo install --locked --root /opt/ntdsextract2 ntdsextract2

FROM alpine:3.21
RUN apk add --no-cache libgcc
COPY --from=build /opt/ntdsextract2/bin/ntdsextract2 /usr/local/bin/ntdsextract2
COPY start.sh /start.sh
RUN chmod +x /start.sh && mkdir -p /data
WORKDIR /data
ENTRYPOINT ["/start.sh"]