theinfobots/arch-devsec repository overview

⁠arch-devsec

Arch Linux development & defensive security lab container.

A rolling-release Arch Linux environment packed with programming languages, CLI tools, network analysis utilities, binary analysis frameworks, and defensive security tools — ready to mount your project into and get to work.

⁠What's included

⁠Languages & runtimes

⁠Development & build

base-devel · cmake · ninja · meson · clang · llvm · lldb · gdb · strace · ltrace · valgrind · git · git-lfs · github-cli

⁠CLI productivity

neovim · tmux · zsh · ripgrep · fd · fzf · bat · lsd · jq · yq · htop · hyperfine

⁠Network & recon

nmap · masscan · tcpdump · tshark · wireshark-cli · socat · openbsd-netcat · mtr · whois · bind/dig · proxychains-ng · openssh

⁠Reverse engineering & binary analysis

radare2 · binwalk · pwndbg · hexedit · file · strings · objdump · readelf

⁠Defensive security & forensics

yara · clamav (with signatures) · lynis · rkhunter · aide · auditd · python-scapy

⁠Python security libraries (pre-installed)

pwntools · impacket · cryptography · httpx · paramiko · capstone · keystone-engine · angr · frida-tools · volatility3 · scapy

⁠Go security tools (compiled at build time)

subfinder · httpx (projectdiscovery) · nuclei · ffuf · waybackurls · anew

⁠Quick start

# Basic interactive shell
docker run --rm -it \
  -v "$PWD:/workspace" \
  theinfobots/arch-devsec:latest

# With network capture capabilities (tcpdump / tshark)
docker run --rm -it \
  --network host \
  --cap-add NET_ADMIN \
  --cap-add NET_RAW \
  -v "$PWD:/workspace" \
  theinfobots/arch-devsec:latest

# With ptrace for gdb / strace against container processes
docker run --rm -it \
  --cap-add SYS_PTRACE \
  --security-opt seccomp=unconfined \
  -v "$PWD:/workspace" \
  theinfobots/arch-devsec:latest

⁠Build locally

git clone https://github.com/theinfobots/arch-devsec
cd arch-devsec
docker build --pull -t theinfobots/arch-devsec:latest .

⁠Security notes

• Do not run with --privileged unless you have a specific reason.
• Do not mount /var/run/docker.sock inside the container.
• --network host combined with NET_RAW/NET_ADMIN grants significant network access — use only in isolated lab environments.
• The container runs as root by default (Arch base image behaviour). Create a non-root user if deploying in shared environments.

⁠Tags

Built and maintained by theinfobots⁠.