blacktop / docker-volatility

Volatility Dockerfile
MIT License
30 stars 6 forks source link

Multi-Arch Support #13

Open cyb3rw0lf opened 1 year ago

cyb3rw0lf commented 1 year ago

Is it possible to add Multi-Arch support? Trying to run this on Linux ARM64 VM in Apple silicon

cyb3rw0lf commented 1 year ago

I tried building it for ARM64 but it seems that there's no arm version in alpine for some of volatilty dependencies ca-certificates zlib py-pillow py-crypto py-lxml py-setuptools

└─$ docker buildx build --platform linux/arm64 --tag test2.6 .                                                                                              1 ⨯
WARNING: No output specified with docker-container driver. Build result will only remain in the build cache. To push result image into registry use --push or to load image into docker use --load
[+] Building 6.1s (5/7)                                                                                                                                         
 => [internal] load .dockerignore                                                                                                                          0.0s
 => => transferring context: 164B                                                                                                                          0.0s
 => [internal] load build definition from Dockerfile                                                                                                       0.0s
 => => transferring dockerfile: 1.09kB                                                                                                                     0.0s
 => [internal] load metadata for docker.io/blacktop/yara:3.7                                                                                               6.0s
 => CACHED [1/4] FROM docker.io/blacktop/yara:3.7@sha256:30c85f7ebf24e4af9e1076ef5476de9d78a7903be99941a0769923d0652ea13e                                  0.0s
 => => resolve docker.io/blacktop/yara:3.7@sha256:30c85f7ebf24e4af9e1076ef5476de9d78a7903be99941a0769923d0652ea13e                                         0.0s
 => ERROR [2/4] RUN apk add --no-cache ca-certificates zlib py-pillow py-crypto py-lxml py-setuptools                                                      0.1s
------
 > [2/4] RUN apk add --no-cache ca-certificates zlib py-pillow py-crypto py-lxml py-setuptools:
#0 0.054 standard_init_linux.go:228: exec user process caused: no such file or directory
------
Dockerfile:8
--------------------
   6 |     
   7 |     # Install Volatility Dependancies
   8 | >>> RUN apk add --no-cache ca-certificates zlib py-pillow py-crypto py-lxml py-setuptools
   9 |     RUN apk add --no-cache -t .build-deps \
  10 |       openssl-dev \
--------------------
ERROR: failed to solve: process "/bin/sh -c apk add --no-cache ca-certificates zlib py-pillow py-crypto py-lxml py-setuptools" did not complete successfully: exit code: 1
blacktop commented 1 year ago

I tried updating and vol.py is still py2... 😞

what YEAR is it!?!?!?

cyb3rw0lf commented 1 year ago

I know right, there's volatility3 but still missing lots of plugin. I anyway need to use 2.6 for an exam :/