基于Docker的CTF Pwn环境构建与部署实践<\/h1>

概述<\/h2>
本文详细讲解如何使用Docker构建和部署CTF Pwn题目环境，涵盖GitHub Actions自动化流程、Docker容器配置、安全沙箱设置等关键技术要点。<\/p>

核心注意点<\/h2>

1. 分支命名规范<\/h3>
分支名称需要与工作流文件和项目目录保持一致<\/li>
示例：项目名为pwn-ret2text<\/code>，则分支名应为pwn-ret2text<\/code><\/li>
工作流文件路径：.github\/workflows\/pwn-ret2text.yml<\/code><\/li>
<\/ul>
2. 端口配置管理<\/h3>

双层屏障设计<\/strong>：

服务器端口：由Docker分配，对外提供服务<\/li>
容器内部端口：由应用程序绑定（通常为8000）<\/li>
<\/ul>
<\/li>
测试时需确保两层端口映射正确<\/li>
<\/ul>
3. 本地测试验证<\/h3>

构建完成后需在本地拉取镜像进行功能测试<\/li>
验证端口开放和题目正常运行<\/li>
<\/ul>
项目结构规范<\/h2>
目录层次<\/h3>
your-repo\/
├── pwn-ret2text\/                    # 项目目录
│   ├── build\/                       # 构建目录
│   │   ├── Dockerfile              # 容器构建文件
│   │   ├── post-build.sh           # 后处理脚本
│   │   └── src\/                    # 源码目录
│   │       ├── start.sh            # 启动脚本
│   │       └── pwn                 # 二进制文件
│   └── attachments\/                # 附件目录（自动生成）
└── .github\/
    └── workflows\/
        └── pwn-ret2text.yml        # GitHub工作流
<\/code><\/pre>
核心配置文件详解<\/h2>
1. GitHub工作流配置（pwn-xxx.yml）<\/h3>
基础版本（仅GHCR）<\/h4>
name<\/span>: pwn-ret2text<\/span>
<\/span><\/span>
<\/span><\/span>on<\/span>:
<\/span><\/span>  push<\/span>:
<\/span><\/span>    branches<\/span>: [pwn-ret2text]<\/span>
<\/span><\/span>    paths<\/span>:
<\/span><\/span>      - "pwn-ret2text\/**"<\/span>
<\/span><\/span>      - ".github\/workflows\/pwn-ret2text.yml"<\/span>
<\/span><\/span>  workflow_dispatch<\/span>:
<\/span><\/span>
<\/span><\/span>env<\/span>:
<\/span><\/span>  NAME<\/span>: pwn-ret2text<\/span>
<\/span><\/span>  IMAGE_PREFIX<\/span>: ghcr.io\/${{ github.repository_owner }}<\/span>
<\/span><\/span>
<\/span><\/span>jobs<\/span>:
<\/span><\/span>  challenge-build<\/span>:
<\/span><\/span>    runs-on<\/span>: ubuntu-latest<\/span>
<\/span><\/span>    permissions<\/span>:
<\/span><\/span>      contents<\/span>: read<\/span>
<\/span><\/span>      packages<\/span>: write<\/span>
<\/span><\/span>      id-token<\/span>: write<\/span>
<\/span><\/span>    
<\/span><\/span>    steps<\/span>:
<\/span><\/span>      # 代码检出<\/span>
<\/span><\/span>      - name<\/span>: Checkout code<\/span>
<\/span><\/span>        uses<\/span>: actions\/checkout@v4<\/span>
<\/span><\/span>        with<\/span>:
<\/span><\/span>          lfs<\/span>: true<\/span>
<\/span><\/span>          submodules<\/span>: true<\/span>
<\/span><\/span>      
<\/span><\/span>      # Dockerfile检查<\/span>
<\/span><\/span>      - name<\/span>: Check Dockerfile<\/span>
<\/span><\/span>        run<\/span>: |
<\/span><\/span><\/span>          dockerfile_path="${{ env.NAME }}\/build\/Dockerfile"
<\/span><\/span><\/span>          if [ ! -f "$dockerfile_path" ]; then
<\/span><\/span><\/span>            echo "❌ Dockerfile not found!"
<\/span><\/span><\/span>            exit 1
<\/span><\/span><\/span>          fi<\/span>          
<\/span><\/span>      
<\/span><\/span>      # 容器注册表登录<\/span>
<\/span><\/span>      - name<\/span>: Login to ghcr.io<\/span>
<\/span><\/span>        uses<\/span>: docker\/login-action@v3<\/span>
<\/span><\/span>        with<\/span>:
<\/span><\/span>          registry<\/span>: ghcr.io<\/span>
<\/span><\/span>          username<\/span>: ${{ github.actor }}<\/span>
<\/span><\/span>          password<\/span>: ${{ secrets.GITHUB_TOKEN }}<\/span>
<\/span><\/span>      
<\/span><\/span>      # 镜像构建推送<\/span>
<\/span><\/span>      - name<\/span>: Build and push image<\/span>
<\/span><\/span>        uses<\/span>: docker\/build-push-action@v5<\/span>
<\/span><\/span>        with<\/span>:
<\/span><\/span>          context<\/span>: ${{ env.NAME }}\/build<\/span>
<\/span><\/span>          push<\/span>: true<\/span>
<\/span><\/span>          tags<\/span>: ${{ env.IMAGE_PREFIX }}\/${{ env.NAME }}:latest<\/span>
<\/span><\/span>      
<\/span><\/span>      # 后处理脚本<\/span>
<\/span><\/span>      - name<\/span>: Run post-build script<\/span>
<\/span><\/span>        working-directory<\/span>: ${{ env.NAME }}\/build<\/span>
<\/span><\/span>        env<\/span>:
<\/span><\/span>          GITHUB_REPOSITORY_OWNER<\/span>: ${{ github.repository_owner }}<\/span>
<\/span><\/span>          NAME<\/span>: ${{ env.NAME }}<\/span>
<\/span><\/span>          IMAGE_TAG<\/span>: ${{ env.IMAGE_PREFIX }}\/${{ env.NAME }}:latest<\/span>
<\/span><\/span>        run<\/span>: |
<\/span><\/span><\/span>          chmod +x post-build.sh
<\/span><\/span><\/span>          .\/post-build.sh<\/span>          
<\/span><\/span>      
<\/span><\/span>      # 附件上传<\/span>
<\/span><\/span>      - name<\/span>: Upload attachments<\/span>
<\/span><\/span>        uses<\/span>: actions\/upload-artifact@v4<\/span>
<\/span><\/span>        with<\/span>:
<\/span><\/span>          name<\/span>: ${{ env.NAME }}-attachments<\/span>
<\/span><\/span>          path<\/span>: ${{ env.NAME }}\/attachments\/<\/span>
<\/span><\/span>
<\/span><\/span>  # 镜像清理<\/span>
<\/span><\/span>  prune-old-images<\/span>:
<\/span><\/span>    runs-on<\/span>: ubuntu-latest<\/span>
<\/span><\/span>    needs<\/span>: challenge-build<\/span>
<\/span><\/span>    if<\/span>: always()<\/span>
<\/span><\/span>    permissions<\/span>:
<\/span><\/span>      packages<\/span>: write<\/span>
<\/span><\/span>    steps<\/span>:
<\/span><\/span>      - name<\/span>: Get package name<\/span>
<\/span><\/span>        id<\/span>: pkg<\/span>
<\/span><\/span>        run<\/span>: |
<\/span><\/span><\/span>          pkg_name=$(echo '${{ env.NAME }}' | tr '[:upper:]' '[:lower:]')
<\/span><\/span><\/span>          echo "pkg_name=$pkg_name" >> "$GITHUB_OUTPUT"<\/span>          
<\/span><\/span>      
<\/span><\/span>      - name<\/span>: Clean old images<\/span>
<\/span><\/span>        uses<\/span>: dataaxiom\/ghcr-cleanup-action@v1<\/span>
<\/span><\/span>        with<\/span>:
<\/span><\/span>          token<\/span>: ${{ secrets.GITHUB_TOKEN }}<\/span>
<\/span><\/span>          owner<\/span>: ${{ github.repository_owner }}<\/span>
<\/span><\/span>          package<\/span>: ${{ steps.pkg.outputs.pkg_name }}<\/span>
<\/span><\/span>          exclude-tags<\/span>: latest<\/span>
<\/span><\/span>          dry-run<\/span>: true<\/span>
<\/span><\/span>          delete-untagged<\/span>: true<\/span>
<\/span><\/span>          delete-ghost-images<\/span>: true<\/span>
<\/span><\/span><\/code><\/pre>多注册表版本（GHCR + 阿里云ACR）<\/h4>
name<\/span>: pwn-func_err<\/span>
<\/span><\/span>
<\/span><\/span>on<\/span>:
<\/span><\/span>  push<\/span>:
<\/span><\/span>    branches<\/span>: [pwn-func_err]<\/span>
<\/span><\/span>    paths<\/span>:
<\/span><\/span>      - "pwn-func_err\/**"<\/span>
<\/span><\/span>      - ".github\/workflows\/pwn-func_err.yml"<\/span>
<\/span><\/span>  workflow_dispatch<\/span>:
<\/span><\/span>
<\/span><\/span>env<\/span>:
<\/span><\/span>  NAME<\/span>: pwn-func_err<\/span>
<\/span><\/span>
<\/span><\/span>jobs<\/span>:
<\/span><\/span>  challenge-build<\/span>:
<\/span><\/span>    runs-on<\/span>: ubuntu-latest<\/span>
<\/span><\/span>    permissions<\/span>:
<\/span><\/span>      contents<\/span>: read<\/span>
<\/span><\/span>      packages<\/span>: write<\/span>
<\/span><\/span>    
<\/span><\/span>    steps<\/span>:
<\/span><\/span>      - name<\/span>: Checkout repository<\/span>
<\/span><\/span>        uses<\/span>: actions\/checkout@v4<\/span>
<\/span><\/span>        with<\/span>:
<\/span><\/span>          lfs<\/span>: true<\/span>
<\/span><\/span>          submodules<\/span>: true<\/span>
<\/span><\/span>      
<\/span><\/span>      # 双注册表登录<\/span>
<\/span><\/span>      - name<\/span>: Log in to ghcr.io<\/span>
<\/span><\/span>        uses<\/span>: docker\/login-action@v3<\/span>
<\/span><\/span>        with<\/span>:
<\/span><\/span>          registry<\/span>: ghcr.io<\/span>
<\/span><\/span>          username<\/span>: ${{ github.actor }}<\/span>
<\/span><\/span>          password<\/span>: ${{ secrets.GITHUB_TOKEN }}<\/span>
<\/span><\/span>      
<\/span><\/span>      - name<\/span>: Log in to Aliyun Container Registry<\/span>
<\/span><\/span>        uses<\/span>: docker\/login-action@v3<\/span>
<\/span><\/span>        with<\/span>:
<\/span><\/span>          registry<\/span>: ${{ secrets.ACR_REGISTRY }}<\/span>
<\/span><\/span>          username<\/span>: ${{ secrets.ACR_USERNAME }}<\/span>
<\/span><\/span>          password<\/span>: ${{ secrets.ACR_PASSWORD }}<\/span>
<\/span><\/span>      
<\/span><\/span>      # 元数据提取<\/span>
<\/span><\/span>      - name<\/span>: Extract metadata<\/span>
<\/span><\/span>        id<\/span>: meta<\/span>
<\/span><\/span>        uses<\/span>: docker\/metadata-action@v5<\/span>
<\/span><\/span>        with<\/span>:
<\/span><\/span>          images<\/span>: |
<\/span><\/span><\/span>            ghcr.io\/${{ github.repository }}\/${{ env.NAME }}
<\/span><\/span><\/span>            ${{ secrets.ACR_REGISTRY }}\/${{ secrets.ACR_NAMESPACE }}\/${{ env.NAME }}<\/span>            
<\/span><\/span>          tags<\/span>: |
<\/span><\/span><\/span>            <\/span>            latest<\/span>
<\/span><\/span>      
<\/span><\/span>      # 构建推送<\/span>
<\/span><\/span>      - name<\/span>: Build and push Docker image<\/span>
<\/span><\/span>        uses<\/span>: docker\/build-push-action@v5<\/span>
<\/span><\/span>        with<\/span>:
<\/span><\/span>          context<\/span>: ${{ env.NAME }}\/build<\/span>
<\/span><\/span>          tags<\/span>: ${{ steps.meta.outputs.tags }}<\/span>
<\/span><\/span>          labels<\/span>: ${{ steps.meta.outputs.labels }}<\/span>
<\/span><\/span>          push<\/span>: true<\/span>
<\/span><\/span>      
<\/span><\/span>      - name<\/span>: Post build tasks<\/span>
<\/span><\/span>        working-directory<\/span>: ${{ env.NAME }}\/build<\/span>
<\/span><\/span>        run<\/span>: |
<\/span><\/span><\/span>          chmod +x post-build.sh
<\/span><\/span><\/span>          .\/post-build.sh<\/span>          
<\/span><\/span>      
<\/span><\/span>      - name<\/span>: Upload attachments<\/span>
<\/span><\/span>        uses<\/span>: actions\/upload-artifact@v4<\/span>
<\/span><\/span>        with<\/span>:
<\/span><\/span>          name<\/span>: ${{ env.NAME }}<\/span>
<\/span><\/span>          path<\/span>: ${{ env.NAME }}\/attachments\/<\/span>
<\/span><\/span><\/code><\/pre>2. Dockerfile配置<\/h3>
基础版本（C语言程序）<\/h4>
FROM<\/span> ubuntu:24.04 AS builder<\/span>
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span>FROM<\/span> debian:bookworm-slim<\/span>
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span># 基础依赖<\/span>
<\/span><\/span><\/span><\/span>RUN<\/span> apt-get update &&<\/span> apt-get install -y --no-install-recommends \
<\/span><\/span><\/span><\/span>    socat \
<\/span><\/span><\/span><\/span>    &&<\/span> rm -rf \/var\/lib\/apt\/lists\/*
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span># 用户和目录设置<\/span>
<\/span><\/span><\/span><\/span>RUN<\/span> groupadd -r ctf &&<\/span> useradd -r -g ctf ctf &&<\/span> \
<\/span><\/span><\/span><\/span>    mkdir -p \/home\/ctf &&<\/span> \
<\/span><\/span><\/span><\/span>    chown ctf:ctf \/home\/ctf
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span># 启动脚本<\/span>
<\/span><\/span><\/span><\/span>COPY<\/span> src\/start.sh \/start.sh
<\/span><\/span><\/span><\/span>RUN<\/span> chmod +x \/start.sh
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span>WORKDIR<\/span> \/home\/ctf\/<\/span>
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span># 程序文件<\/span>
<\/span><\/span><\/span><\/span>COPY<\/span> src\/pwn .
<\/span><\/span><\/span><\/span>RUN<\/span> chmod +x pwn
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span># 依赖库复制<\/span>
<\/span><\/span><\/span><\/span>COPY<\/span> --from=<\/span>builder \/lib64\/ld-linux-x86-64.so.2 \/home\/ctf\/lib64\/
<\/span><\/span><\/span><\/span>COPY<\/span> --from=<\/span>builder \/lib\/x86_64-linux-gnu\/libc.so.6 \/home\/ctf\/lib\/x86_64-linux-gnu\/
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span># 基础命令<\/span>
<\/span><\/span><\/span><\/span>RUN<\/span> mkdir -p \/home\/ctf\/bin &&<\/span> \
<\/span><\/span><\/span><\/span>    cp \/bin\/sh \/home\/ctf\/bin\/ &&<\/span> \
<\/span><\/span><\/span><\/span>    cp \/bin\/cat \/home\/ctf\/bin\/ &&<\/span> \
<\/span><\/span><\/span><\/span>    cp \/bin\/ls \/home\/ctf\/bin\/ &&<\/span> \
<\/span><\/span><\/span><\/span>    chmod +x \/home\/ctf\/bin\/*
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span>EXPOSE<\/span> 8000<\/span>
<\/span><\/span><\/span><\/span>CMD<\/span> ["\/start.sh"<\/span>]
<\/span><\/span><\/span><\/code><\/pre>C++程序完整版本<\/h4>
# Builder阶段：提供标准运行时库<\/span>
<\/span><\/span><\/span><\/span>FROM<\/span> ubuntu:24.04 AS builder<\/span>
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span>RUN<\/span> apt-get update &&<\/span> \
<\/span><\/span><\/span><\/span>    apt-get install -y --no-install-recommends \
<\/span><\/span><\/span><\/span>    libc6 \
<\/span><\/span><\/span><\/span>    libstdc++6 \
<\/span><\/span><\/span><\/span>    libgcc-s1 \
<\/span><\/span><\/span><\/span>    &&<\/span> rm -rf \/var\/lib\/apt\/lists\/*
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span># Runtime阶段<\/span>
<\/span><\/span><\/span><\/span>FROM<\/span> debian:bookworm-slim<\/span>
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span>RUN<\/span> apt-get update &&<\/span> \
<\/span><\/span><\/span><\/span>    apt-get install -y --no-install-recommends socat &&<\/span> \
<\/span><\/span><\/span><\/span>    rm -rf \/var\/lib\/apt\/lists\/*
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span>RUN<\/span> groupadd -r ctf &&<\/span> \
<\/span><\/span><\/span><\/span>    useradd -r -g ctf ctf &&<\/span> \
<\/span><\/span><\/span><\/span>    mkdir -p \/home\/ctf &&<\/span> \
<\/span><\/span><\/span><\/span>    chown ctf:ctf \/home\/ctf
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span>COPY<\/span> src\/start.sh \/start.sh
<\/span><\/span><\/span><\/span>RUN<\/span> chmod +x \/start.sh
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span>WORKDIR<\/span> \/home\/ctf<\/span>
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span>COPY<\/span> src\/pwn .
<\/span><\/span><\/span><\/span>RUN<\/span> chmod +x pwn
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span># 关键：完整库文件复制<\/span>
<\/span><\/span><\/span><\/span>COPY<\/span> --from=<\/span>builder \/lib64\/ld-linux-x86-64.so.2 \/home\/ctf\/lib64\/
<\/span><\/span><\/span><\/span>COPY<\/span> --from=<\/span>builder \/lib\/x86_64-linux-gnu\/libc.so.6 \/home\/ctf\/lib\/x86_64-linux-gnu\/
<\/span><\/span><\/span><\/span>COPY<\/span> --from=<\/span>builder \/lib\/x86_64-linux-gnu\/libstdc++.so.6 \/home\/ctf\/lib\/x86_64-linux-gnu\/
<\/span><\/span><\/span><\/span>COPY<\/span> --from=<\/span>builder \/lib\/x86_64-linux-gnu\/libgcc_s.so.1 \/home\/ctf\/lib\/x86_64-linux-gnu\/
<\/span><\/span><\/span><\/span>COPY<\/span> --from=<\/span>builder \/lib\/x86_64-linux-gnu\/libm.so.6 \/home\/ctf\/lib\/x86_64-linux-gnu\/
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span>RUN<\/span> mkdir -p \/home\/ctf\/lib64 \/home\/ctf\/lib\/x86_64-linux-gnu
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span>COPY<\/span> --from=<\/span>builder \/bin\/sh \/home\/ctf\/bin\/
<\/span><\/span><\/span><\/span>COPY<\/span> --from=<\/span>builder \/bin\/cat \/home\/ctf\/bin\/
<\/span><\/span><\/span><\/span>COPY<\/span> --from=<\/span>builder \/bin\/ls \/home\/ctf\/bin\/
<\/span><\/span><\/span><\/span>RUN<\/span> chmod +x \/home\/ctf\/bin\/*
<\/span><\/span><\/span>
<\/span><\/span><\/span><\/span>EXPOSE<\/span> 8000<\/span>
<\/span><\/span><\/span><\/span>CMD<\/span> ["\/start.sh"<\/span>]
<\/span><\/span><\/span><\/code><\/pre>沙盒环境额外依赖<\/h4>
# 沙盒逃逸题目需要额外添加<\/span>
<\/span><\/span><\/span><\/span>COPY<\/span> src\/libseccomp.so.2 .\/lib\/x86_64-linux-gnu\/
<\/span><\/span><\/span><\/code><\/pre>3. 后处理脚本（post-build.sh）<\/h3>
#!\/bin\/bash
<\/span><\/span><\/span><\/span>
<\/span><\/span># 配置区<\/span>
<\/span><\/span>IMAGE_TAG=<\/span>"<\/span>${<\/span>IMAGE_TAG:-<\/span>ghcr.io\/${<\/span>GITHUB_REPOSITORY_OWNER}<\/span>\/${<\/span>NAME}<\/span>:latest}<\/span>"<\/span>
<\/span><\/span>CONTAINER_PWN_PATH=<\/span>"\/home\/ctf\/pwn"<\/span>
<\/span><\/span>CONTAINER_LIBC_PATH=<\/span>"\/home\/ctf\/lib\/x86_64-linux-gnu\/libc.so.6"<\/span>
<\/span><\/span>CONTAINER_LD_PATH=<\/span>"\/home\/ctf\/lib64\/ld-linux-x86-64.so.2"<\/span>
<\/span><\/span>ATTACHMENTS_DIR=<\/span>"..\/attachments"<\/span>
<\/span><\/span>
<\/span><\/span>echo "===== Starting post-build attachment extraction ====="<\/span>
<\/span><\/span>
<\/span><\/span># 镜像检查<\/span>
<\/span><\/span>if<\/span> ! docker image inspect "<\/span>$IMAGE_TAG"<\/span> &> \/dev\/null; then<\/span>
<\/span><\/span>    echo "❌ Error: Image <\/span>$IMAGE_TAG not found"<\/span>
<\/span><\/span>    exit 1<\/span>
<\/span><\/span>fi<\/span>
<\/span><\/span>
<\/span><\/span># 创建临时容器<\/span>
<\/span><\/span>echo "Creating temporary container from image..."<\/span>
<\/span><\/span>CONTAINER_ID=<\/span>$(<\/span>docker create "<\/span>$IMAGE_TAG"<\/span>)<\/span>
<\/span><\/span>if<\/span> [<\/span> -z "<\/span>$CONTAINER_ID"<\/span> ]<\/span>; then<\/span>
<\/span><\/span>    echo "❌ Error: Failed to create container"<\/span>
<\/span><\/span>    exit 1<\/span>
<\/span><\/span>fi<\/span>
<\/span><\/span>
<\/span><\/span>mkdir -p "<\/span>$ATTACHMENTS_DIR"<\/span>
<\/span><\/span>
<\/span><\/span># 文件复制函数<\/span>
<\/span><\/span>copy_file()<\/span> {<\/span>
<\/span><\/span>    local src=<\/span>"<\/span>$1"<\/span>
<\/span><\/span>    local dest_dir=<\/span>"<\/span>$2"<\/span>
<\/span><\/span>    local filename=<\/span>$(<\/span>basename "<\/span>$src"<\/span>)<\/span>
<\/span><\/span>    
<\/span><\/span>    if<\/span> docker cp "<\/span>$CONTAINER_ID:<\/span>$src"<\/span> "<\/span>$dest_dir\/"<\/span> &> \/dev\/null; then<\/span>
<\/span><\/span>        echo "✅ Copied: <\/span>$filename"<\/span>
<\/span><\/span>    else<\/span>
<\/span><\/span>        echo "⚠️ Warning: Failed to copy <\/span>$filename"<\/span>
<\/span><\/span>    fi<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span>
<\/span><\/span># 复制关键文件<\/span>
<\/span><\/span>copy_file "<\/span>$CONTAINER_PWN_PATH"<\/span> "<\/span>$ATTACHMENTS_DIR"<\/span>
<\/span><\/span>copy_file "<\/span>$CONTAINER_LIBC_PATH"<\/span> "<\/span>$ATTACHMENTS_DIR"<\/span>
<\/span><\/span>copy_file "<\/span>$CONTAINER_LD_PATH"<\/span> "<\/span>$ATTACHMENTS_DIR"<\/span>
<\/span><\/span>
<\/span><\/span># 清理<\/span>
<\/span><\/span>docker rm -v "<\/span>$CONTAINER_ID"<\/span> &> \/dev\/null
<\/span><\/span>echo "Temporary container removed: <\/span>$CONTAINER_ID"<\/span>
<\/span><\/span>
<\/span><\/span>echo "===== Attachment extraction completed ====="<\/span>
<\/span><\/span>ls -l "<\/span>$ATTACHMENTS_DIR"<\/span>
<\/span><\/span><\/code><\/pre>4. 启动脚本（start.sh）<\/h3>
#!\/bin\/sh
<\/span><\/span><\/span><\/span>
<\/span><\/span># 多平台Flag支持<\/span>
<\/span><\/span>if<\/span> [<\/span> "<\/span>$A1CTF_FLAG"<\/span> ]<\/span>; then<\/span>
<\/span><\/span>    INSERT_FLAG=<\/span>"<\/span>$A1CTF_FLAG"<\/span>
<\/span><\/span>    unset A1CTF_FLAG
<\/span><\/span>elif<\/span> [<\/span> "<\/span>$PCTF_FLAG"<\/span> ]<\/span>; then<\/span>
<\/span><\/span>    INSERT_FLAG=<\/span>"<\/span>$PCTF_FLAG"<\/span>
<\/span><\/span>    unset PCTF_FLAG
<\/span><\/span>elif<\/span> [<\/span> "<\/span>$GZCTF_FLAG"<\/span> ]<\/span>; then<\/span>
<\/span><\/span>    INSERT_FLAG=<\/span>"<\/span>$GZCTF_FLAG"<\/span>
<\/span><\/span>    unset GZCTF_FLAG
<\/span><\/span>elif<\/span> [<\/span> "<\/span>$FLAG"<\/span> ]<\/span>; then<\/span>
<\/span><\/span>    INSERT_FLAG=<\/span>"<\/span>$FLAG"<\/span>
<\/span><\/span>    unset FLAG
<\/span><\/span>else<\/span>
<\/span><\/span>    INSERT_FLAG=<\/span>"PCTF{!!!!_FLAG_ERROR_ASK_ADMIN_!!!!}"<\/span>
<\/span><\/span>fi<\/span>
<\/span><\/span>
<\/span><\/span># Flag文件设置<\/span>
<\/span><\/span>echo -n $INSERT_FLAG > \/home\/ctf\/flag
<\/span><\/span>INSERT_FLAG=<\/span>""<\/span>
<\/span><\/span>chown ctf:ctf \/home\/ctf\/flag
<\/span><\/span>
<\/span><\/span># 沙盒环境准备<\/span>
<\/span><\/span>cp \/bin\/sh \/home\/ctf\/sh &&<\/span> chmod +x \/home\/ctf\/sh
<\/span><\/span>
<\/span><\/span># 服务启动<\/span>
<\/span><\/span>socat -T60 TCP-LISTEN:8000,reuseaddr,fork EXEC:"\/usr\/sbin\/chroot \/home\/ctf .\/pwn"<\/span>,stderr
<\/span><\/span><\/code><\/pre>5. 资源配置文件（README.md）<\/h3>
Port: 70
CPU(0.1c): 1
Memory(1M): 32
Disk(1M): 128
<\/code><\/pre>
部署与测试流程<\/h2>
1. 代码管理操作<\/h3>
# 远程连接和分支建立<\/span>
<\/span><\/span>git remote add origin <repository-url>
<\/span><\/span>git checkout -b pwn-ret2text
<\/span><\/span>git push -u origin pwn-ret2text
<\/span><\/span>
<\/span><\/span># 手动触发首次构建（必需）<\/span>
<\/span><\/span>git add .
<\/span><\/span>git commit -m "Initial pwn challenge setup"<\/span>
<\/span><\/span>git push
<\/span><\/span><\/code><\/pre>2. 权限配置<\/h3>
GitHub令牌申请<\/h4>

访问：https:\/\/github.com\/settings\/tokens<\/li>
生成新的Personal Access Token<\/li>
权限范围需包含：repo, workflow, package<\/li>
<\/ol>
环境变量配置<\/h4>

仓库Settings → Secrets and variables → Actions<\/li>
添加必要密钥：

ACR_REGISTRY<\/code>：阿里云容器注册表地址<\/li>
ACR_USERNAME<\/code>：阿里云用户名<\/li>
ACR_PASSWORD<\/code>：阿里云密码<\/li>
<\/ul>
<\/li>
<\/ol>
Docker密钥配置<\/h4>

访问：https:\/\/app.docker.com\/accounts<\/li>
配置访问凭证<\/li>
<\/ol>
3. 本地测试命令<\/h3>
# 清理环境<\/span>
<\/span><\/span>docker system prune -a --volumes
<\/span><\/span>docker logout ghcr.io
<\/span><\/span>
<\/span><\/span># 拉取镜像<\/span>
<\/span><\/span>docker pull ghcr.io\/ziranan\/pwn-ret2text:latest
<\/span><\/span>
<\/span><\/span># 运行容器（两种方式）<\/span>
<\/span><\/span># 交互式运行<\/span>
<\/span><\/span>docker run -it --rm -p 8000:8000 --name pwn ghcr.io\/ziranan\/pwn-ret2text:latest
<\/span><\/span>
<\/span><\/span># 后台运行<\/span>
<\/span><\/span>docker run -d --name pwn -p 8000:8000 ghcr.io\/ziranan\/pwn-ret2text:latest
<\/span><\/span>nc localhost 8000<\/span>
<\/span><\/span>
<\/span><\/span># 容器状态检查<\/span>
<\/span><\/span>docker ps -a
<\/span><\/span><\/code><\/pre>4. 问题排查<\/h3>
权限问题解决<\/h4>
# 查看当前配置<\/span>
<\/span><\/span>git config --global --list
<\/span><\/span>
<\/span><\/span># 令牌验证问题解决<\/span>
<\/span><\/span># 参考：https:\/\/github.com\/settings\/tokens<\/span>
<\/span><\/span><\/code><\/pre>容器清理<\/h4>
# 停止所有容器<\/span>
<\/span><\/span>docker stop $(<\/span>docker ps -q)<\/span>
<\/span><\/span>
<\/span><\/span># 删除所有容器<\/span>
<\/span><\/span>docker rm $(<\/span>docker ps -a -q)<\/span>
<\/span><\/span>
<\/span><\/span># 系统清理<\/span>
<\/span><\/span>docker system prune -a --volumes
<\/span><\/span><\/code><\/pre>仓库管理<\/h4>

删除问题仓库：通过GitHub界面操作<\/li>
重新建立干净的仓库环境<\/li>
<\/ul>
最佳实践总结<\/h2>

分支管理<\/strong>：严格保持分支名、工作流文件名、项目目录名的一致性<\/li>
端口规划<\/strong>：明确区分服务器端口和容器内部端口<\/li>
依赖管理<\/strong>：根据程序语言选择正确的库文件复制策略<\/li>
安全沙箱<\/strong>：使用chroot限制文件系统访问，复制最小必要命令<\/li>
多平台支持<\/strong>：启动脚本兼容主流CTF平台的Flag传递方式<\/li>
自动化流程<\/strong>：利用GitHub Actions实现构建、测试、部署全自动化<\/li>
资源清理<\/strong>：定期清理旧镜像版本，优化存储空间使用<\/li>
<\/ol>
通过以上完整配置和流程，可以建立稳定可靠的CTF Pwn题目Docker化部署方案，满足比赛和训练环境的需求。<\/p>
基于Docker的CTF Pwn环境构建与部署实践<\/h1>

概述<\/h2> 本文详细讲解如何使用Docker构建和部署CTF Pwn题目环境，涵盖GitHub Actions自动化流程、Docker容器配置、安全沙箱设置等关键技术要点。<\/p>

核心注意点<\/h2>

项目结构规范<\/h2>

核心配置文件详解<\/h2>

1. GitHub工作流配置（pwn-xxx.yml）<\/h3>

2. Dockerfile配置<\/h3>

部署与测试流程<\/h2>

2. 权限配置<\/h3>

4. 问题排查<\/h3>

概述<\/h2>
本文详细讲解如何使用Docker构建和部署CTF Pwn题目环境，涵盖GitHub Actions自动化流程、Docker容器配置、安全沙箱设置等关键技术要点。<\/p>
