Initial Docker packaging

README.md

@@ -0,0 +1,76 @@
+# Relapse Exploit Docker
+
+Container packaging for [PS5 Relapse Exploit](https://github.com/ntfargo/Relapse-Exploit).
+The upstream project is pinned as a Git submodule, and the image build verifies the
+SHA-256 digest of every executable payload before including it.
+
+Use this only on consoles you own or are authorized to test. The exploit can panic
+the console, corrupt kernel state, expose administrative services, and execute
+arbitrary code with elevated privileges.
+
+## Clone and build
+
+```sh
+git clone --recurse-submodules <repository-url>
+cd relapse-exploit-docker
+docker compose build
+```
+
+For an existing clone:
+
+```sh
+git submodule update --init --recursive
+docker compose build
+```
+
+## Run
+
+```sh
+docker compose up -d
+```
+
+Open `http://HOST-IP:8000/` from the PS5. View the service status with:
+
+```sh
+docker compose ps
+docker compose logs -f
+```
+
+Stop it with `docker compose down`.
+
+By default, port 8000 is exposed on every host interface so the PS5 can reach it.
+Restrict it to one host address when possible:
+
+```sh
+HOST_BIND=192.168.1.10 HOST_PORT=8000 docker compose up -d
+```
+
+Do not expose this service to the internet. Prefer an isolated local network.
+
+## Update upstream
+
+Review upstream changes before updating because the served JavaScript and payloads
+ultimately execute with kernel privileges.
+
+```sh
+git -C app fetch origin
+git -C app checkout <reviewed-commit>
+sha256sum app/payloads/*
+```
+
+After reviewing the new binaries, update `payloads.sha256`, rebuild, test, and commit
+both the submodule pointer and checksum changes together.
+
+## Container hardening
+
+The runtime image:
+
+- contains only the files required by the exploit page;
+- runs as numeric user/group `65532:65532`;
+- has a read-only filesystem, all Linux capabilities dropped, and no-new-privileges;
+- disables directory listings and browser caching;
+- adds restrictive browser security headers;
+- does not expose the upstream `.git` directory.
+
+These controls protect the host-side web server. They do not make the PS5 exploit or
+its precompiled payloads intrinsically safe.