# Relapse Exploit Docker

Container packaging for [PS5 Relapse Exploit](https://github.com/ntfargo/Relapse-Exploit).
The upstream project is pinned as a Git submodule, and the image build verifies the
SHA-256 digest of every executable payload before including it.

The Compose stack also includes a local PS5 User Guide gateway: authoritative DNS
for `manuals.playstation.net`, HTTP/HTTPS redirect to the local exploit, allowlisted
DNS forwarding for the homebrew store, and NXDOMAIN for every other domain so the
console cannot resolve PSN or update services.

Use this only on consoles you own or are authorized to test. The exploit can panic
the console, corrupt kernel state, expose administrative services, and execute
arbitrary code with elevated privileges.

Documentation:

- [PS5 setup, DNS, deployment, and troubleshooting](docs/PS5_SETUP.md)
- [Maintainer and agent handoff](docs/HANDOFF.md)
- [Y2JB / Relapse controlled test record](docs/Y2JB_TEST_2026-10-02.md)
- [External payload candidate evidence](docs/payload-evidence/README.md)
- [Repository instructions for coding agents](AGENTS.md)

## Current deployment

The maintained LAN deployment runs on `net-utils01` from
`/opt/relapse-exploit-docker`:

| Service | LAN endpoint | Purpose |
| --- | --- | --- |
| Relapse page | `http://192.168.20.30:8000/` | Exploit page and payload assets |
| Restricted DNS | `192.168.20.30:53` UDP/TCP | User Guide override and store allowlist |
| User Guide gateway | `192.168.20.30:80` and `:443` TCP | Redirect to the local Relapse page |

Configure the PS5 with primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`.
The DNS gateway resolves `manuals.playstation.net` locally and forwards only
`homebrew.page`, `itsplk.github.io`, `store.spectrumlibrary.online`,
`api.github.com`, `github.com`, and `release-assets.githubusercontent.com` to its
configured upstream resolver. These names cover the homebrew store, the official
PS5 Payload Manager catalog and downloads, and Spectrum Library's fixed API and
update endpoints; every other name receives NXDOMAIN.

The console needs LAN access to DNS UDP/TCP 53 and TCP 80, 443, and 8000 on
`192.168.20.30`. For the online applications it also needs WAN egress on TCP 443 to
the six allowlisted domains; no WAN ingress rule is required. The server needs DNS
egress on UDP/TCP 53 to its configured resolver (`1.1.1.1` by default).

The Payload Manager supports arbitrary custom repository URLs. Those hosts are not
allowed automatically: review the repository JSON, payload URLs, checksums, and
redirect destinations before adding another exact hostname to `FORWARDED_DOMAINS`.

Spectrum Library is distributed without source code in its repository. Static
review of its 1.4.8 ELF identified `store.spectrumlibrary.online` for its API and
`api.github.com` for update checks. Catalog responses can supply additional cover,
manifest, and package URLs; these unknown hosts remain blocked until observed and
reviewed. The Spectrum API returned HTTP 502 during the 2026-10-07 review, so DNS
availability alone does not guarantee that its catalog will load.

To deploy a reviewed commit:

```sh
ssh net-utils01
cd /opt/relapse-exploit-docker
git pull --ff-only
git submodule update --init --recursive
docker compose up -d --build
docker compose ps
curl -I http://127.0.0.1:8000/
```

Both Compose services must report `healthy`. Runtime changes require the rebuild
above; documentation-only changes need only the fast-forward pull.

## Clone and build

```sh
git clone --recurse-submodules <repository-url>
cd relapse-exploit-docker
docker compose build
```

For an existing clone:

```sh
git submodule update --init --recursive
docker compose build
```

## Run

```sh
docker compose up -d
```

Open `http://HOST-IP:8000/` from the PS5. View the service status with:

```sh
docker compose ps
docker compose logs -f
```

Stop it with `docker compose down`.

By default, port 8000 is exposed on every host interface so the PS5 can reach it.
Restrict it to one host address when possible:

```sh
HOST_BIND=192.168.1.10 HOST_PORT=8000 docker compose up -d
```

Do not expose this service to the internet. Prefer an isolated local network.

## Update upstream

Review upstream changes before updating because the served JavaScript and payloads
ultimately execute with kernel privileges.

```sh
git -C app fetch origin
git -C app checkout <reviewed-commit>
sha256sum app/payloads/*
```

After reviewing the new binaries, update `payloads.sha256`, rebuild, test, and commit
both the submodule pointer and checksum changes together.

The currently pinned upstream snapshot includes only the kernel exploit payload and
the ELF loader. It no longer bundles etaHEN, KStuff, or ShadowMount+ because upstream
removed those compatibility-sensitive payloads. After the loader starts, send any
separately reviewed ELF to the PS5 on TCP port 9021 with an external payload sender.

## Container hardening

The runtime image:

- contains only the files required by the exploit page;
- runs as numeric user/group `65532:65532`;
- has a read-only filesystem, all Linux capabilities dropped, and no-new-privileges;
- disables directory listings and browser caching;
- adds restrictive browser security headers;
- does not expose the upstream `.git` directory.

These controls protect the host-side web server. They do not make the PS5 exploit or
its precompiled payloads intrinsically safe.