[PurpleCHOIms]

Summary

Locally built :dev images and rolling-version apt layers made the sandbox the dominant disk/push cost of the project: a locally built :dev sandbox shares almost no layers with its GHCR release twin (~10 GB parked per release-verify cycle), and kali-rolling re-resolves package versions on every build so the 2.4 GB tool layer was re-pushed to GHCR in full on every release even with no tool bump. This PR pins the Go recon toolchain to GitHub releases (checksum-verified, one layer per tool), moves Chromium and the Exploit-DB corpus behind opt-out build ARGs (defaults unchanged for release images), strips non-English locales in the installing layer, and adds make clean-dev-images for the release-verify lifecycle. With both flags off, the sandbox builds at 3.48 GB vs 5.36 GB (-35%).

Changes

• containers/sandbox.Dockerfile: new go-tools fetch stage — subfinder, httpx(-toolkit), katana, nuclei, naabu, gobuster fetched as pinned release binaries (ARGs at top), each verified against the project's checksums.txt (naming is inconsistent per project — katana dashes, naabu drops the version, gobuster omits it from the archive name — so the checksum filename is passed explicitly per tool); arch-aware for the multi-arch amd64/arm64 build via TARGETARCH. Final stage COPYs one tool per layer, so a single-tool bump re-pushes only that tool. httpx is installed as httpx-toolkit to keep the kali package name operators invoke.
• INSTALL_BROWSER ARG (default true): Chromium (~1 GB) opt-out. With the binary absent, INSANE_CHROMIUM_PATH still points at the missing path so a stray browser-tier call fails immediately with a missing-executable error instead of falling back to a Playwright Chrome download inside the sandbox.
• INSTALL_EXPLOITDB ARG (default true): Exploit-DB corpus (~290 MB) opt-out, in its own layer. A shared-volume variant (one corpus volume for N sandboxes) would save the same MBs for release images too, but needs a decision on first-run population versus the sandbox egress allowlist lifecycle — deliberately not wired here.
• Non-English locales stripped inside the tool-install layer (deletions only reclaim image MB in the same layer).
• docker-compose.yml: sandbox build args pass INSTALL_BROWSER / INSTALL_EXPLOITDB through, so INSTALL_BROWSER=false INSTALL_EXPLOITDB=false docker compose build sandbox and INSTALL_BROWSER=false ... make smoke opt out.
• Makefile: clean-dev-images target — removes :dev-tagged decepticon images and dangling layers; docker rmi skips images still in use, so it is safe while a stack is up.
• CHAGELOG.md: Unreleased (proposed) entry.

Intent

• Issue / ADR this satisfies: build-maintenance follow-up to the ADR-0010 sandbox topology (no ADR change; docs/adr/0010-open-web-acquisition.md behavior is untouched — release image defaults are byte-identical apart from stripped locales).
• Anti-goal (one thing this PR could have done but deliberately does not): defaulting the Exploit-DB corpus to a shared volume — first-run population would need GitHub (or kali CDN) reachability from the sandbox at container start, which interacts with the nftables egress allowlist lifecycle and needs a maintainer decision, not a drive-by default flip.

Blast radius

• Tier-supply-chain — compose / Dockerfiles. Reaches every OSS user on the next release: request a review and wait for it.

  • If ticked, paste a Why this touches a supply-chain surface paragraph below, and confirm the PR changes that surface and nothing else:

    Why this touches a supply-chain surface: the PR edits containers/sandbox.Dockerfile (the shipped sandbox image recipe), docker-compose.yml (the shipped compose contract) — every OSS user builds/pulls from these on the next release. Two new build ARGs default to true, so release image contents are unchanged apart from stripped non-English locales and the six Go tools now coming from checksum-verified GitHub releases instead of the kali apt mirror. Nothing outside containers/sandbox.Dockerfile, docker-compose.yml, Makefile, CHAGELOG.md is touched.

Diff budget

• My diff fits the budget. (4 files; CHAGELOG.md is docs-excluded; the Dockerfile diff is majority comment.)

End-to-end verification

Built the sandbox from this branch with docker build -f containers/sandbox.Dockerfile --build-arg INSTALL_BROWSER=false --build-arg INSTALL_EXPLOITDB=false -t decepticon-sandbox:lean-test2 . — completed successfully; docker images reports 3.48 GB vs 5.36 GB for the current 2.2.0 release image. Inside the built image (docker run --rm --network none --entrypoint /bin/sh decepticon-sandbox:lean-test2 -c ...): subfinder -version → v2.17.0, httpx-toolkit -version → v1.12.0, katana -version → v1.8.0, nuclei -version → v3.11.1, naabu -version → 2.6.1, gobuster help shows VERSION section; searchsploit and chromium absent as intended; tmux -V (the image healthcheck) → 3.7c; nmap --version → 7.991; python3 -c "import fastapi, curl_cffi" OK; /usr/share/locale 82 MB → 764 KB. An earlier lean build (browser flag only, exploitdb still bundled, tools still from apt) also completed at 3.84 GB with all apt-installed tools present, confirming the flag gating works on both paths. docker build --check -f containers/sandbox.Dockerfile . → "Check complete, no warnings found"; docker compose config --quiet passes with and without the flags set (with a throwaway .env, since the repo ships .env.example).

Testing

• make quality passes (Python + CLI + Web) — not run: no Python/CLI/Web code changed (Dockerfile, compose, Makefile, changelog only)
• make smoke succeeds (clean local build + OSS-style up + health checks) — not run in full; the sandbox image build + entrypoint/healthcheck dependency (tmux) was verified directly as described above
• pytest tests/ passes — not run: no Python changed
• Every new/changed code path was executed on my machine, not just unit-tested in isolation (both flag-off builds, per-tool version checks, docker build --check, docker compose config)
• Manual testing: full build matrix described under End-to-end verification

Quality Bar self-check

• No banned pattern from QUALITY_BAR §Banned patterns appears in the diff.
• No AI-slop signature from QUALITY_BAR §AI-slop signatures survives.
• Every changed line traces to the stated intent. No drive-by formatting, renaming, or reordering.
• No new public functions added (Dockerfile/compose/Makefile only).
• I would merge this PR if a stranger opened it.
• If I were tired and reviewing this at the end of a long day, I would still merge it.

Related Issues

None — build-maintenance follow-up; no open issue tracks this.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T04:00:59.556294Z	4d2b92a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.