cider-security-research / cicd-goat

A deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.
Apache License 2.0
1.94k stars 321 forks source link

M1/ARM support for CTFd, localstack, GitLab #73

Closed zylideum closed 9 months ago

zylideum commented 9 months ago

ARM64 Support

When following the instructions to grab the repository and run docker-compose, I noticed CTFd, localstack, and GitLab were not starting properly. The issue was an exec format error, meaning a lack of architecture support for ARM.

I was able to get both localstack and CTFd working as both now support ARM64 images inherently.

Solutions

localstack

With localstack, I simply changed the docker-compose to pull localstack/localstack which now selects the appropriate image based on architecture: https://docs.localstack.cloud/references/arm64-support/

However, I understand the security implications of using the latest tag with 3rd-party supplied images, so if it helps at all I did test and ensure that the last static tag does in fact work with no conflicts in the project: localstack/localstack:3.0.2

CTFd

For CTFd, I had to build a new image locally since I don't have access to the goat-ctfd instance. This was also a pretty simple fix, as CTFd also now supports ARM64. I changed the Dockerfile to pull FROM --platform=linux/arm64 ctfd/ctfd:3.5.1 and tested to verify it works with no conflicts.

https://hub.docker.com/layers/ctfd/ctfd/3.5.1/images/sha256-2bbc8da5bf789d16513efdc44a343c6a3c02c5b997cd6f989f48c70b292f04de

I'm not sure how to use the multi-arch version of this going forward as I'm pretty new to these concepts (this in and of itself was a fun project) - clearly this would need to change to be adopted for all users of the project.

GitLab

It appears that GitLab does not (?) officially support a multi-arch Docker image that supports ARM64. Looking into solutions for this.

Pull Request

As I'm fairly new to these concepts and this would be my first PR, please don't hesitate to add any necessary code that I'm missing. Appreciate the team for creating the project and hoping I can help others using M1/ARM systems to engage with it!