FROM python:3.10-slim

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y --no-install-recommends \
    git \
    build-essential \
    binutils \
    file \
    grep \
    curl \
    unzip \
    && rm -rf /var/lib/apt/lists/*

RUN pip install --no-cache-dir \
    volatility3 \
    pefile \
    pycryptodome \
    capstone \
    yara-python

RUN ln -s /usr/local/bin/vol /usr/local/bin/volatility

RUN mkdir -p /usr/local/lib/python3.10/site-packages/volatility3/symbols \
    && curl -o /usr/local/lib/python3.10/site-packages/volatility3/symbols/windows.zip \
       https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip

WORKDIR /data

CMD ["bash"]