mirror of
https://github.com/alexmi256/rea-agent-docker.git
synced 2026-11-07 09:45:59 -10:00
Hermes Agent
596f7befb3
- REA_ENGINE=(all|ghidra|hopper|ida) selects the native engine; the engine layers are built LAST so every earlier layer is shared cache across the four variants (docs/ARCHITECTURE.md layer map updated). - Each image declares itself: /etc/rea/engine (marker), /etc/rea/engine.env (only the paths it needs, plus REA_ANALYSIS_PROVIDER for single-engine images), and a /usr/local/bin/rea wrapper that sources engine.env - so `docker exec -i <ctr> rea mcp` finds the engine with no compose environment, and an image without Ghidra never advertises GHIDRA_INSTALL_DIR. - healthcheck, entrypoint and the verification harness are engine-aware: they read /etc/rea/engine and SKIP (with a reason) checks for engines the image does not ship. One harness verifies all four images. - compose: one service per engine (rea-agent, rea-ghidra, rea-hopper, rea-ida) with per-engine env and home volumes; engine-agnostic HTTP bridge sidecar; IDA overlay applies to both rea-agent and rea-ida. - scripts: build.sh --engine, build-all.sh, verify-all-engines.sh; Makefile gains per-engine build/up/verify/sizes targets; CI matrix (ghidra on push, all four on workflow_dispatch). - fix: runtime user creation is now tolerant of Ubuntu's stock uid/gid 1000 (groupadd failed with 'GID 1000 already exists' when REA_UID was unset), and build.sh passes REA_UID/REA_GID through from the environment/.env. - docs: new IMAGES.md (per-engine guide) and ida-variants.md (IDA vs IDA Pro: one program, four licence plans; which edition can drive REA and how); README/HERMES-MCP/BYO-LICENSES/ARCHITECTURE/TROUBLESHOOTING updated.
80 lines
3.4 KiB
YAML
80 lines
3.4 KiB
YAML
# =============================================================================
|
|
# Optional overlay: make REA analyse natively through IDA.
|
|
#
|
|
# Which image you use this with:
|
|
# -f docker-compose.yml -f compose.ida.yml --profile ida up -d rea-ida
|
|
# the dedicated `rea-ida` service (no bundled engine; smallest image)
|
|
# -f docker-compose.yml -f compose.ida.yml up -d rea-agent
|
|
# the all-engines image, using IDA instead of Ghidra/Hopper
|
|
#
|
|
# IDA is NOT redistributable, so this repo never ships it. Two supported
|
|
# arrangements (see docs/ida-variants.md and docs/BYO-LICENSES.md):
|
|
#
|
|
# A. IDA inside this container
|
|
# - put your installer in vendor/ida/ and build with INSTALL_IDA=1, or
|
|
# - bind-mount an existing install: IDA_INSTALL_DIR=/opt/ida-pro-9.4
|
|
# - bind-mount your licence: ./config/ida/ida.hexlic
|
|
# - install the MCP server once: docker compose exec rea-ida \
|
|
# /opt/rea/scripts/setup-ida-mcp.sh idalib
|
|
# - config/ida-mcp.json is generated by that script.
|
|
#
|
|
# B. IDA MCP running elsewhere (sidecar container, VM, another host)
|
|
# - start it with the `ida-sidecar` profile below, or run it yourself
|
|
# - REA only accepts loopback endpoints, so this overlay forwards
|
|
# 127.0.0.1:8745 -> ${IDA_MCP_FORWARD_TARGET} inside the container.
|
|
#
|
|
# IDA Free cannot do this headlessly: it ships no idalib and no automation
|
|
# API. You need IDA Pro or IDA Home (see docs/ida-variants.md).
|
|
# =============================================================================
|
|
name: rea-agent
|
|
|
|
x-ida-overlay: &ida-overlay
|
|
environment:
|
|
REA_ANALYSIS_PROVIDER: ${REA_ANALYSIS_PROVIDER:-ida}
|
|
# Point this at a registration file; /etc/rea/ida-mcp.json comes from
|
|
# ./config/ida-mcp.json (see docs/ida-variants.md).
|
|
REA_IDA_MCP_CONFIG: ${REA_IDA_MCP_CONFIG:-/etc/rea/ida-mcp.json}
|
|
IDADIR: ${IDADIR:-/opt/ida}
|
|
REA_IDA_MCP_LOCAL_PORT: ${REA_IDA_MCP_LOCAL_PORT:-8745}
|
|
# REA_IDA_MCP_FORWARD (only for a sidecar/remote IDA MCP) is optional and
|
|
# must not be defined empty - REA rejects empty values. Put it in
|
|
# ./config/rea.env, e.g. REA_IDA_MCP_FORWARD=ida-mcp:8745
|
|
volumes:
|
|
- ${IDA_INSTALL_DIR:-./vendor/ida}:/opt/ida:ro
|
|
- ${IDA_LICENSE_DIR:-./config/ida}:/etc/rea/ida:ro
|
|
- ${IDA_MCP_CONFIG_FILE:-./config/ida-mcp.json}:/etc/rea/ida-mcp.json:ro
|
|
|
|
services:
|
|
rea-agent:
|
|
<<: *ida-overlay
|
|
|
|
rea-ida:
|
|
<<: *ida-overlay
|
|
|
|
# --- B: the user's own private IDA MCP image -------------------------------
|
|
# Enabled only with: docker compose ... --profile ida-sidecar up -d
|
|
# IDA_MCP_IMAGE must point at an image you built yourself from your own IDA
|
|
# installer + licence (see ida/README.md for a starting Dockerfile).
|
|
ida-mcp:
|
|
profiles: ["ida-sidecar"]
|
|
image: ${IDA_MCP_IMAGE:-busybox:latest} # placeholder; set IDA_MCP_IMAGE in .env
|
|
container_name: ${REA_CONTAINER_NAME:-rea-agent}-ida-mcp
|
|
platform: linux/amd64
|
|
init: true
|
|
restart: unless-stopped
|
|
environment:
|
|
IDADIR: ${IDADIR:-/opt/ida}
|
|
IDA_MCP_MAX_WORKERS: ${IDA_MCP_MAX_WORKERS:-1}
|
|
volumes:
|
|
- ${IDA_INSTALL_DIR:-./vendor/ida}:/opt/ida:ro
|
|
- ${IDA_LICENSE_DIR:-./config/ida}:/home/ida/.idapro:ro
|
|
- ida-work:/work
|
|
# Official Hex-Rays MCP server over Streamable HTTP:
|
|
command: ["ida-mcp", "http", "--host", "0.0.0.0", "--port", "8745"]
|
|
expose:
|
|
- "8745"
|
|
|
|
volumes:
|
|
ida-work:
|
|
name: ${REA_CONTAINER_NAME:-rea-agent}-ida-work
|