docker-compose.yml

services:
  java-chains:
    image: javachains/javachains:2.0.0-beta5
    container_name: java-chains
    restart: unless-stopped
    ports:
      - "8011:8011"      # Web / Studio
      - "58080:58080"    # JNDI HTTP
      - "50389:50389"    # JNDI LDAP
      - "50388:50388"    # JNDI RMI
      - "13999:13999"    # JRMPListener
      - "3308:3308"      # Fake MySQL
      - "11527:11527"    # TCP Server
      - "50000:50000"    # HTTP Server
    environment:
      # true=开启 Web 登录鉴权；false 需同时设置 CHAINS_ALLOW_AUTH_DISABLED=true
      CHAINS_AUTH: ${CHAINS_AUTH:-true}
      # 为空则启动时随机生成密码（docker logs | grep -i auth → "Auth" 行）
      CHAINS_PASS: ${CHAINS_PASS:-}
      CHAINS_ALLOW_AUTH_DISABLED: ${CHAINS_ALLOW_AUTH_DISABLED:-false}
      # 可选：启动时查询公网 IP（会访问第三方 IP 回显服务）
      CHAINS_SHOW_PUBLIC_IP: ${CHAINS_SHOW_PUBLIC_IP:-false}
    volumes:
      # Persist config / plugins / presets / FakeMySQL captures.
      # Prefer copying chains-config from the release tarball next to this file.
      # An empty host dir still works for writes (entrypoint chowns it for appuser),
      # but hides the image's baked-in chains-config — copy from the tarball for plugins.
      - ./chains-config:/chains/chains-config
      # Optional: mount a host path you want available *inside* the container for
      # other tooling. FakeMySQLReadPayload does NOT read host/container files itself —
      # the victim JDBC client reads the path you configure (e.g. /etc/passwd on the victim).
      # Captures land in chains-config/cache/fake-server-files/.
      # - /path/on/host:/chains/host-files:ro
    # Optional: run as a specific host UID/GID instead of image appuser.
    # Entrypoint skips chown when not root; ensure the volume is writable by that user.
    # user: "1000:1000"
    networks:
      - java-chains-net

networks:
  java-chains-net:
    driver: bridge