Docker

[oj]

Docker

[0xdevalias]

Probably use FROM golang, maybe from alpine. And then I was thinking it might make sense to use the new multi-build stages coming in 17.0.5 to separate the compile/run steps, and end up with just the compiled binary:

• moby/moby#31257
• moby/moby#32063

Something akin to:

• StefanScherer/dockerfiles-windows#105

So maybe something like (untested)..

FROM golang:alpine

COPY . /gobuster
WORKDIR /gobuster

RUN go build main.go

FROM scratch

COPY --from=0 /gobuster/gobuster /gobuster

CMD ["gobuster"]

That said, the onbuild version works as an ok one liner at the moment too:

FROM golang:onbuild

[0xdevalias]

Decided to hack this together today (finally). Multi-stage build, staticly linked, stripped, packed, FROM scratch:

• https://blog.filippo.io/shrink-your-go-binaries-with-this-one-weird-trick/

Leaves us with a ~1.35mb docker container:

• https://hub.docker.com/r/devalias/gobuster/

Can run like:

docker run --rm -v "/Users/foo/sec/seclists:/seclists" devalias/gobuster -w /seclists/Discovery/Web_Content/common.txt -u http://example.com/

DockerHub isn't yet running the latest docker, so multi stage automated builds are broken for now, but that should be updated within the month. For now just manually built/pushed:

• docker/hub-feedback#1039

Currently sitting on a branch on my fork. Was thinking of figuring out how I could have it build both alpine and scratch images automagically, and wait for automated build to land on dockerhub, though can send a PR if desired:

• https://github.com/alias1/gobuster/blob/docker/Dockerfile

[OJ]

Thanks mate this looks great! I'll dive into it a bit more later on. Thanks for the effort 👍

[OJ]

I'd be open to it, depending on the container and what it intends to do. I know a few people have their own implementations of it as well, so perhaps you'll get some commentary from them along the way.

[0xdevalias]

Sounds good :)

[0xdevalias]

So I think i've decided that maintaining the dockerfile separate to the main repo will end up a better experience for updates/etc.

Created https://github.com/0xdevalias/docker-gobuster with my latest iterations. At some point will work it a bit better to provide tagged versions rather than just 'latest' (once I figure how that works)

Would be happy to have it linked up as a 'semi-official' type docker image if you'd be keen.

[firefart]

a dockerfile was already added to the repo