[Help] Custom docker images

[n1ckisthereu]

Hi everyone, I'd first like to say I'm sorry to create a topic to ask for help with this. I know this isn't the purpose here, but when I asked for help on Telegram, besides being ignored, I was treated very badly.

Anyway, I'd like to know how I can create a custom image with pre-installed packages. I have a "containerfile" that I've been using for months, but the image doesn't work with DistroBox. 90% of the packages I installed disappear, and the configurations I made also disappear. I can't create an image that's ready to use in any way.

I know there's an overlay and several directories are mounted on top. I've tried various things, I just wanted to know if there's a solution for this, and if so, what it is. I really liked the project; with the little time I have, it fulfills a very important need in my workflow.

container file:

FROM docker.io/kalilinux/kali-rolling:latest

WORKDIR /distrobox

COPY ./install.sh .
COPY ./init.sh .

RUN chmod +x install.sh && \
  chmod +x init.sh && \
  ./install.sh

WORKDIR /

ENTRYPOINT [ "/usr/bin/zsh" ]

assemble file:

[kali]
image=localhost/kali:custom
pull=false
nvidia=false
root=true
replace=false
start_now=false
init_hooks=""
pre_init_hooks="export SHELL=/usr/bin/zsh;"
skip_workdir=1

install.sh

#!/bin/bash

apt update && DEBIAN_FRONTEND=noninteractive apt install -y \
  nmap \
  wireshark \
  iproute2 \
  net-tools \
  aircrack-ng \
  burpsuite \
  hashcat \
  hydra \
  nuclei \
  amass \
  metasploit-framework \
  lsd \
  zsh \
  wget \
  curl &&
  apt clean

init.sh

#!/bin/bash

USERNAME=$1

groupadd wireshark
usermod -aG wireshark $USERNAME
setcap cap_net_raw,cap_net_admin=ep /usr/bin/dumpcap
chsh -s zsh $USERNAME

[dottorblaster]

The containerfile is missing the FROM statement and you didn't paste the content of init.sh and install.sh, so it's very difficult to understand what you're trying to do here.

Could you expand a little bit?

[n1ckisthereu]

@dottorblaster Ty for help, I edit the original message with these infos.

I'm starting now making my workflow, I know this can show confuse, but is a test to try to create a custom image, to have a custom image is awesome to my workflow

[dottorblaster]

You can have a custom image but for the purpose you are trying to achieve I think a manifest file would be sufficient.

[kali]
image=docker.io/kalilinux/kali-rolling:latest
pull=true
nvidia=false
root=true
replace=false
init_hooks=""
pre_init_hooks="export SHELL=/usr/bin/zsh;"
skip_workdir=1
additional_packages="nmap wireshark net-tools"
additional_packages="lsd zsh aircrack-ng"
# more additional_packages line here with the packages you actually need
container_init_hook="path-to-init.sh"

Try distrobox assemble-ing something like this and you should be pretty much covered.

[n1ckisthereu]

@dottorblaster

I understand, I'm using it like this at the moment; however, this isn't the final file. I was just trying to create a custom image. For my purposes, having a custom image would be excellent, but I haven't been able to achieve that result yet.

[dottorblaster]

I don't understand why you can't do whatever you're trying to to with an assemble file instead of a custom image. Anyway, I would need logs to inspect the behavior of the custom image and most importantly you would have to provide the complete files and the complete workflow you're trying to achieve, something that at the moment seems very secret.

[n1ckisthereu]

Actually, I was just trying to run an image I have from work. It installed some tools we have here, and some, like in the Dockerfile above, also have internal company network configurations. I've already extracted a file that connects, etc. That's why I didn't share it. I was trying to create a custom image to understand how it worked, but unfortunately I couldn't. I looked for a guide, but I didn't find anyone who had created their own Dockerfile. If you have one I could use as inspiration and try to make it work, that would be great. But I won't waste any more of your time pushing the idea of ​​creating a custom image, as I believe it won't be very promising since I can't provide much information about the image. If there's no further contact, thank you for your support. Feel free to close this issue.

[dottorblaster]

@n1ckisthereu I just wanted to know what was going on under the hood 😅 because usually custom images are sort of a last resort, especially when you don't have the containerfile. Most probably distrobox will not work with just a random container coming from the internet, because usually container images tend to drop most of the userland to lower the attack surface (for example, see distroless containers).

I didn't want to simply close this as maybe someone has a good answer out of the blue to the topic, so I just moved it to discussions.

It is absolutely possible to have a custom image, but from the things you wrote it looks like that container image in particular has a lot of things baked in that will get in your way of making it work well.

I would tell you to create a multi stage build with docker build with a manifest that does something along these lines

FROM the_cursed_image AS layer1
COPY some/network/configuration
COPY some/strange/executable

FROM docker.io/kalilinux/kali-rolling:latest
COPY --from=layer1 all/the/stuff/you/need

This should work.

If you want to look into something more complex there's also Jorge Castro's boxkit.

[n1ckisthereu]

@dottorblaster Hello friend, I have a new perspective on this problem. Maybe it's a bug, or maybe it's just my brain's fault.

When I run the container without the --root flag, as a normal user and not as root, the installed packages are preserved. Copying files into it isn’t very important right now — if I can just keep the packages, I’ll be eternally grateful for this project.

I tried creating it layer by layer, but the files didn’t persist in the container. As soon as I manage to keep the packages, I plan to test boxkit. I believe this discussion will be very helpful for others in the future.

[n1ckisthereu]

Good evening, gentlemen, sorry for insisting here, I've been using DistroBox a lot recently, and it's becoming exceptional for me. However, I still haven't been able to successfully run this flow on a root machine. Last week I ventured into the DistroBox code and studied Podman/Docker a bit more to try and understand why this is happening, but I haven't made any progress yet. I would love to collaborate on the project. I strongly believe this is a bug, @dottorblaster , should I file a bug report?

[dottorblaster]

@n1ckisthereu thank you for trying, unless you can't provide a complete scenario to reproduce the bug I would avoid opening a bug report. If you manage to consistently reproduce that and can post detailed instructions about how to do that you can do that instead.

[n1ckisthereu]

Good morning, everyone. I’m pleased to report that this wasn’t a bug — it was simply my oversight.

Over the weekend, I decided to document the steps to reproduce the issue. I created a custom Ubuntu image and tried to access it as root. That’s when I noticed that the image wasn’t being found when using the --root flag. Then I remembered that when I created my first custom image, I had the same “problem”: I ran podman build as root, and afterward ran another podman build without root.

In other words, the image I was testing didn’t contain the installed packages or the files I had copied. After running sudo podman images, I realized that the only image available was from two weeks ago.

[dottorblaster]

Glad you found the way out of the rabbithole!