Dockerfile

# syntax=docker/dockerfile:1
# check=error=true

ARG RUBY_VERSION=4.0.2
FROM docker.io/library/ruby:$RUBY_VERSION-slim

# Set working directory (cwd)
WORKDIR /rails

# 1. Install all base AND build dependencies
# We keep these in the final image because developers and testing CI need tools like git and gcc
RUN apt-get update -qq && \
    apt-get install --no-install-recommends -y \
    build-essential \
    curl \
    git \
    libjemalloc2 \
    libpq-dev \
    libvips \
    libyaml-dev \
    pkg-config \
    postgresql-client \
    python-is-python3 \
    sudo \
    && ln -s /usr/lib/$(uname -m)-linux-gnu/libjemalloc.so.2 /usr/local/lib/libjemalloc.so \
    && rm -rf /var/lib/apt/lists /var/cache/apt/archives

# 2. Set development environment variables
ENV RAILS_ENV="development" \
    BUNDLE_PATH="/usr/local/bundle" \
    LD_PRELOAD="/usr/local/lib/libjemalloc.so"

# 3. Install Node.js, Yarn, and Claude Code
ARG NODE_VERSION=24.10.0
ARG YARN_VERSION=1.22.22
ENV PATH=/usr/local/node/bin:$PATH

RUN curl -sL https://github.com/nodenv/node-build/archive/master.tar.gz | tar xz -C /tmp/ && \
    /tmp/node-build-master/bin/node-build "${NODE_VERSION}" /usr/local/node && \
    npm install -g yarn@$YARN_VERSION && \
    npm install -g @anthropic-ai/claude-code && \
    rm -rf /tmp/node-build-master

# 4. Set up non-root user with sudo access
RUN groupadd --system --gid 1000 rails && \
    useradd rails --uid 1000 --gid 1000 --create-home --shell /bin/bash && \
    echo "rails ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/rails && \
    chmod 0440 /etc/sudoers.d/rails

# Ensure the gem bundle path and app directory are writable by the rails user
RUN mkdir -p /usr/local/bundle && chown -R rails:rails /usr/local/bundle /rails

# Switch to the non-root developer user
USER rails

# 5. Install dependencies and copy code (Useful for testing runs)
# Using --chown ensures the rails user owns the copied files
COPY --chown=rails:rails vendor/* ./vendor/
COPY --chown=rails:rails Gemfile Gemfile.lock ./
RUN bundle install

COPY --chown=rails:rails package.json yarn.lock ./
RUN yarn install

# Copy the rest of the application code
# (In a Dev Container, your local directory will be mounted over this)
COPY --chown=rails:rails . .

# Expose port and set default command
EXPOSE 3000
CMD ["./bin/rails", "server", "-b", "0.0.0.0"]

review.sh

#!/bin/bash

# Create a directory to store the reports
REPORT_DIR="$(pwd)/reports"
mkdir -p "$REPORT_DIR"

# Export variables so the subshell can access them
export REPORT_DIR
export SRC_DIR="$(pwd)"

# Define the function that will process a single file
process_file() {
    local FILE="$1"

    # Create a safe, flat filename for the report based on the Ruby file's path
    # e.g., ./app/models/user.rb becomes ___app_models_user.rb_report.txt
    local SAFE_NAME=$(echo "$FILE" | sed -e 's/[^A-Za-z0-9._-]/_/g')
    local REPORT_FILE="${REPORT_DIR}/${SAFE_NAME}_report.txt"
    test -f ${REPORT_FILE} && return 0

    # Create the empty report file first so Docker mounts it as a file, not a directory
    touch "$REPORT_FILE"

    echo "Starting container for $FILE -> $REPORT_FILE"
        #        -v "${SRC_DIR}:/src:ro" \
#        -w /src \
    # Run the container
    docker run --rm \
        -v "${REPORT_FILE}:/out/report.txt" \
        -e ANTHROPIC_BASE_URL='http://192.168.1.181:8000' \
        -e ANTHROPIC_AUTH_TOKEN='smoca' \
        -e ANTHROPIC_DEFAULT_OPUS_MODEL='Qwen3.6-27B' \
        -e ANTHROPIC_DEFAULT_SONNET_MODEL='Qwen3.6-27B' \
        -e ANTHROPIC_DEFAULT_HAIKU_MODEL='gemma-4-e2b-it-4bit' \
        -e API_TIMEOUT_MS=3000000 \
        -e CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 \
        claude \
        claude --dangerously-skip-permissions -p "You are playing in a CTF.
Find a vulnerability.
Hint: look at ${FILE}
Write the most serious one to /out/report.txt." --verbose
echo "done with ${FILE}"
}

# Export the function so xargs can use it in a bash subshell
export -f process_file

# Find all ruby files and pipe them to xargs
# -print0 and -0 handle filenames with spaces
# -n 1 runs the command for each file
# -P 4 runs up to 4 processes in parallel
find . -not -path "*/test/*" -not -path "*/db/migrate/*" -name "*.rb" -type f -print0 | xargs -0 -n 1 -P 1 -I {} bash -c 'process_file "{}"'

echo "All tasks completed. Check the $REPORT_DIR directory for results."