# Victim host: a real, current Suricata + the suricata-update it ships with (the vulnerable component).
# jasonish/suricata:latest provides both. Because a real suricata binary is
# present, suricata-update auto-detects the version (no hardcoded --suricata-version).
FROM jasonish/suricata:latest
COPY run-attack.sh /lab/run-attack.sh
RUN chmod +x /lab/run-attack.sh
ENTRYPOINT []
CMD ["/lab/run-attack.sh"]
