fix(tools): run tools image as non-root operator (#114)

Stage ProjectDiscovery binaries before installing them into /usr/local/bin, run the tools image as the existing Kali operator identity, preserve runtime access to Foundry tools, and cover the non-root Dockerfile and smoke-test contracts.

scripts/check-tools-image.sh

@@ -17,7 +17,7 @@ if ! command -v docker >/dev/null 2>&1; then
 fi
 
 echo "Checking tools image: $IMAGE"
-docker run --rm --platform linux/amd64 "$IMAGE" bash -lc '
+docker run --rm --platform linux/amd64 "$IMAGE" bash -c '
   set -e
   fail=0
   for c in radare2 gdb objdump upx; do

scripts/test-tools-dockerfile.mjs

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+/**
+ * Regression guard for the tools image's non-root runtime contract.
+ *
+ * Python packages install console scripts in /usr/local/bin (including httpx).
+ * Go tools must therefore be built in a staging directory before installation,
+ * otherwise `go install` refuses to overwrite the existing Python script.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const dockerfile = fs.readFileSync(path.join(here, '..', 'tools', 'Dockerfile'), 'utf8');
+const smokeScript = fs.readFileSync(path.join(here, 'check-tools-image.sh'), 'utf8');
+
+let passed = 0;
+let failed = 0;
+
+function check(label, condition) {
+  if (condition) {
+    passed += 1;
+    console.log(`  ok   ${label}`);
+  } else {
+    failed += 1;
+    console.error(`  FAIL ${label}`);
+  }
+}
+
+check(
+  'Go binaries are not built directly into /usr/local/bin',
+  !/export\s+GOBIN=\/usr\/local\/bin/.test(dockerfile),
+);
+check(
+  'Go binaries use a staging directory',
+  /export\s+GOBIN=\/tmp\/projectdiscovery-bin/.test(dockerfile),
+);
+check(
+  'staged Go binaries are installed into /usr/local/bin',
+  /install\s+-m\s+0755\s+"\$GOBIN"\/\*\s+\/usr\/local\/bin\//.test(dockerfile),
+);
+check(
+  'Go staging directory is removed',
+  /rm\s+-rf\s+"\$GOBIN"/.test(dockerfile),
+);
+check(
+  'operator user reuses the existing Kali operator group',
+  /useradd\s+--gid\s+operator\s+--create-home\s+--shell\s+\/bin\/bash\s+operator/.test(dockerfile),
+);
+check('image runtime user is operator', /^USER operator$/m.test(dockerfile));
+check('image runtime workdir is /work', /^WORKDIR \/work$/m.test(dockerfile));
+check(
+  'tools smoke avoids a login shell whose logout hook can mask success',
+  /docker run .* "\$IMAGE" bash -c '/.test(smokeScript) &&
+    !/docker run .* "\$IMAGE" bash -lc '/.test(smokeScript),
+);
+
+console.log(`\n${failed === 0 ? 'PASS' : 'FAIL'}: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);